|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �;�͠Bt�� Ey�����c�8�$W&��/[�ij 5���I��A�@ ��u��Y7�G�I)��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �;�͠Bt��
Ey�����c�8�$W&��/[�ij 5���I��A�@ ��u��Y7�G�I)��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �;�͠Bt�� Ey�����c�8�$W&��/[�ij 5���I��A�@ ��u��Y7�G�I)��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.007440596474763,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "a83cc5cda8b273bd6555b4131ceb1ac8355079b8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "4abae499c443036c8420f634b6ee6b28",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\u0005\ufffd\ufffdA\u0017\ufffd@\u001d\ufffd\u0006\ufffdu\ufffd\ufffdY7\ufffdG\ufffd\bI\u001b)\u0014\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\u0005\ufffd\ufffdA\u0017\ufffd@\u001d\ufffd\u0006\ufffdu\ufffd\ufffdY7\ufffdG\ufffd\bI\u001b)\u0014\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\u0005\ufffd\ufffdA\u0017\ufffd@\u001d\ufffd\u0006\ufffdu\ufffd\ufffdY7\ufffdG\ufffd\bI\u001b)\u0014\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fd285e6699e7335512d3b70c1c2891c7c6d3b5b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\u0005\ufffd\ufffdA\u0017\ufffd@\u001d\ufffd\u0006\ufffdu\ufffd\ufffdY7\ufffdG\ufffd\bI\u001b)\u0014\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\ufffd\ufffdA\ufffd@\ufffd\ufffdu\ufffd\ufffdY7\ufffdG\ufffdI)\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\u0005\ufffd\ufffdA\u0017\ufffd@\u001d\ufffd\u0006\ufffdu\ufffd\ufffdY7\ufffdG\ufffd\bI\u001b)\u0014\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd;\ufffd\u0360Bt\ufffd\ufffd\nEy\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd8\ufffd$W&\ufffd\ufffd\/[\ufffdij 5\ufffd\ufffd\ufffdI\ufffd\ufffdA\ufffd@\ufffd\ufffdu\ufffd\ufffdY7\ufffdG\ufffdI)\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 da8e91c20337a527 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ������C!�\��G�ߋ�م���d.v�B*�@ �� ���sB����!`'[_�9�śb��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������C!�\��G�ߋ�م���d.v�B*�@ ��
���sB����!`'[_�9�śb��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ������C!�\��G�ߋ�م���d.v�B*�@ �� ���sB����!`'[_�9�śb��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "da8e91c20337a527850f2ca92ffa8c17",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.996374898894145,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "8962fc25e1fe6047f9722fb54cb7ec14133f4537",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "da8e91c20337a527850f2ca92ffa8c17",
"payload_hash": "fe4c60725cd5e21721de449f5f5c43dd",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\u0019\\\u000e\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\u0003\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd\u0018!`\u0001'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\u0019\\\u000e\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\u0003\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd\u0018!`\u0001'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\u0019\\\u000e\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\u0003\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd\u0018!`\u0001'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dbfe52aa5d236274680151efff57c974bb6730cd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\u0019\\\u000e\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\u0003\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd\u0018!`\u0001'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "da8e91c20337a527850f2ca92ffa8c17",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\\\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd!`'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\u0019\\\u000e\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\u0003\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd\u0018!`\u0001'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "da8e91c20337a527850f2ca92ffa8c17",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC!\ufffd\\\ufffd\ufffdG\ufffd\u07cb\ufffd\u0645\ufffd\ufffd\ufffdd.v\ufffdB*\ufffd@ \ufffd\ufffd\r\ufffd\ufffd\ufffdsB\ufffd\ufffd\ufffd\ufffd!`'[_\ufffd\u00989\ufffd\u015bb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����=��dF����\�,����aއ��lu�w� pEb�y�Fp2d�Žw� �ւ���R�P �� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����=��dF����\�,����aއ��lu�w� pEb�y�Fp2d�Žw�
�ւ���R�P �� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ����=��dF����\�,����aއ��lu�w� pEb�y�Fp2d�Žw� �ւ���R�P �� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.995103960142319,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "27e2589e3a5fdb3c603887772a211d57",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd=\ufffd\ufffdd\u0018F\ufffd\ufffd\u000f\ufffd\ufffd\\\ufffd,\ufffd\u0006\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdF\u0010p2d\ufffd\u017dw\ufffd\u000b\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\u001e\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd=\ufffd\ufffdd\u0018F\ufffd\ufffd\u000f\ufffd\ufffd\\\ufffd,\ufffd\u0006\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdF\u0010p2d\ufffd\u017dw\ufffd\u000b\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\u001e\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd=\ufffd\ufffdd\u0018F\ufffd\ufffd\u000f\ufffd\ufffd\\\ufffd,\ufffd\u0006\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdF\u0010p2d\ufffd\u017dw\ufffd\u000b\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\u001e\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "78d58ef786dcf6634b628fcf98e006e278ce7a5c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd=\ufffd\ufffdd\u0018F\ufffd\ufffd\u000f\ufffd\ufffd\\\ufffd,\ufffd\u0006\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdF\u0010p2d\ufffd\u017dw\ufffd\u000b\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\u001e\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffddF\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdFp2d\ufffd\u017dw\ufffd\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd=\ufffd\ufffdd\u0018F\ufffd\ufffd\u000f\ufffd\ufffd\\\ufffd,\ufffd\u0006\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdF\u0010p2d\ufffd\u017dw\ufffd\u000b\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\u001e\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffddF\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd\ufffd\ufffd\ufffda\u0787\ufffd\ufffdlu\ufffdw\ufffd pEb\ufffdy\ufffdFp2d\ufffd\u017dw\ufffd\t\r\ufffd\u0582\ufffd\ufffd\ufffdR\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��rB�e��V}B�Ơ��{����i�&�!�U� w�ū��V��m$��M�,o����ml����{* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��rB�e��V}B�Ơ��{����i�&�!�U� w�ū��V��m$��M�,o����ml����{* � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��rB�e��V}B�Ơ��{����i�&�!�U� w�ū��V��m$��M�,o����ml����{* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.05325532181837,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "9dd185c8ac230c08ae622a4d82b0c8f78cdd3665",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "b2fc59c4fdad9d55abe7298351b40b68",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdrB\ufffde\ufffd\ufffdV\u0004}B\ufffd\u01a0\ufffd\ufffd\u0007{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\u0012\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\u0012\ufffd\ufffd{*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdrB\ufffde\ufffd\ufffdV\u0004}B\ufffd\u01a0\ufffd\ufffd\u0007{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\u0012\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\u0012\ufffd\ufffd{*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdrB\ufffde\ufffd\ufffdV\u0004}B\ufffd\u01a0\ufffd\ufffd\u0007{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\u0012\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\u0012\ufffd\ufffd{*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "90128e2eed0c6ff89dfde7a05efa1055abe53009",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdrB\ufffde\ufffd\ufffdV\u0004}B\ufffd\u01a0\ufffd\ufffd\u0007{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\u0012\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\u0012\ufffd\ufffd{*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdrB\ufffde\ufffd\ufffdV}B\ufffd\u01a0\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\ufffd\ufffd{*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdrB\ufffde\ufffd\ufffdV\u0004}B\ufffd\u01a0\ufffd\ufffd\u0007{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\u0012\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\u0012\ufffd\ufffd{*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdrB\ufffde\ufffd\ufffdV}B\ufffd\u01a0\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffdi\ufffd&\ufffd!\ufffdU\ufffd w\ufffd\u016b\ufffd\ufffdV\ufffd\ufffdm$\ufffd\ufffdM\ufffd,o\ufffd\ufffd\ufffd\ufffdml\ufffd\ufffd\ufffd\ufffd{*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���|������`�L'Yk_bi���@p|Y}xC� �v��.`�j�U��q�~ �� c`7������b= � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���|������`�L'Yk_bi���@p|Y}xC� �v��.`�j�U��q�~ ��
c`7������b= � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���|������`�L'Yk_bi���@p|Y}xC� �v��.`�j�U��q�~ �� c`7������b= � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.980518111533459,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "e1858ba530d4b862a8dfe87e1708b88a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd|\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \b \ufffdv\ufffd\ufffd.`\ufffdj\ufffd\u0011U\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd|\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \b \ufffdv\ufffd\ufffd.`\ufffdj\ufffd\u0011U\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd|\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \b \ufffdv\ufffd\ufffd.`\ufffdj\ufffd\u0011U\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "417168aaee5beb016dc9e9894e7713de234be603",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd|\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \b \ufffdv\ufffd\ufffd.`\ufffdj\ufffd\u0011U\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \ufffdv\ufffd\ufffd.`\ufffdj\ufffdU\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd|\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \b \ufffdv\ufffd\ufffd.`\ufffdj\ufffd\u0011U\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffdL'Yk_bi\ufffd\ufffd\ufffd@p|Y}xC\ufffd \ufffdv\ufffd\ufffd.`\ufffdj\ufffdU\ufffd\ufffdq\ufffd~\t\ufffd\ufffd\nc`7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb=\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 aa3b296c52b6a193 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��\4�T_e�� ��"�I:��⊜� D|� ��f0�̓���dT��Edk���ïQ%ZѦ��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��\4�T_e�� ��"�I:��⊜� D|� ��f0�̓���dT��Edk���ïQ%ZѦ��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��\4�T_e�� ��"�I:��⊜� D|� ��f0�̓���dT��Edk���ïQ%ZѦ��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �zz 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "aa3b296c52b6a1939de94fa4b00f8da6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.987252883451238,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "4c926aeff15133fbc0b1f9fec1a4746bf7f4be5e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "aa3b296c52b6a1939de94fa4b00f8da6",
"payload_hash": "803390ef4ef313b9dea8b0dc95997541",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\4\ufffdT_e\ufffd\u0005\ufffd\u001c\ufffd\ufffd\u000f\"\u0016\ufffdI:\ufffd\ufffd\u229c\ufffd\u000b\u0015D|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\u0002\ufffddT\ufffd\ufffdEd\u0016k\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\4\ufffdT_e\ufffd\u0005\ufffd\u001c\ufffd\ufffd\u000f\"\u0016\ufffdI:\ufffd\ufffd\u229c\ufffd\u000b\u0015D|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\u0002\ufffddT\ufffd\ufffdEd\u0016k\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdzz\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\4\ufffdT_e\ufffd\u0005\ufffd\u001c\ufffd\ufffd\u000f\"\u0016\ufffdI:\ufffd\ufffd\u229c\ufffd\u000b\u0015D|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\u0002\ufffddT\ufffd\ufffdEd\u0016k\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "284126da2c38c1c74f1674c4fbd2ea9d6ccf6c22",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\4\ufffdT_e\ufffd\u0005\ufffd\u001c\ufffd\ufffd\u000f\"\u0016\ufffdI:\ufffd\ufffd\u229c\ufffd\u000b\u0015D|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\u0002\ufffddT\ufffd\ufffdEd\u0016k\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "aa3b296c52b6a1939de94fa4b00f8da6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\\4\ufffdT_e\ufffd\ufffd\ufffd\ufffd\"\ufffdI:\ufffd\ufffd\u229c\ufffdD|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\ufffddT\ufffd\ufffdEdk\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\4\ufffdT_e\ufffd\u0005\ufffd\u001c\ufffd\ufffd\u000f\"\u0016\ufffdI:\ufffd\ufffd\u229c\ufffd\u000b\u0015D|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\u0002\ufffddT\ufffd\ufffdEd\u0016k\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "aa3b296c52b6a1939de94fa4b00f8da6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\\4\ufffdT_e\ufffd\ufffd\ufffd\ufffd\"\ufffdI:\ufffd\ufffd\u229c\ufffdD|\ufffd \ufffd\ufffdf0\ufffd\u0343\ufffd\ufffd\ufffddT\ufffd\ufffdEdk\ufffd\ufffd\ufffd\u00efQ%Z\u0466\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T PXD��O�A�J T �+�'s|N#�ߤ1��� �/�B.'et���쟥 ���N�e����P_��`C( F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T PXD��O�A�J T �+�'s|N#�ߤ1��� �/�B.'et���쟥 ���N�e����P_��`C( F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T PXD��O�A�J T �+�'s|N#�ߤ1��� �/�B.'et���쟥 ���N�e����P_��`C( F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.0252111382380065,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "6dd661685edeca9b437b4575e3bc0c9c11076466",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "2c1e6f14405f1db85730c39ab5c56bc8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003XD\ufffd\ufffd\u0005O\ufffdA\ufffdJ\u001cT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\u0019\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\u000b\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003XD\ufffd\ufffd\u0005O\ufffdA\ufffdJ\u001cT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\u0019\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\u000b\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003XD\ufffd\ufffd\u0005O\ufffdA\ufffdJ\u001cT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\u0019\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\u000b\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e34843d1dc826efa2cd0c49c5f02a87b35638b77",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003XD\ufffd\ufffd\u0005O\ufffdA\ufffdJ\u001cT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\u0019\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\u000b\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TPXD\ufffd\ufffdO\ufffdA\ufffdJT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003XD\ufffd\ufffd\u0005O\ufffdA\ufffdJ\u001cT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\u0019\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\u000b\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TPXD\ufffd\ufffdO\ufffdA\ufffdJT \ufffd+\ufffd's|N#\ufffd\u07e41\u0082\ufffd\ufffd\ufffd \ufffd\/\ufffdB.'et\ufffd\ufffd\ufffd\uc7e5\ufffd\ufffd\ufffdN\ufffde\ufffd\ufffd\ufffd\ufffdP_\ufffd\ufffd`C(F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B2'�b�&���n�7\PF����G��o�I?� �ߩ�o� �#�܀%:D�0b���^Ӆ|ؒ� w� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B2'�b�&���n�7\PF����G��o�I?� �ߩ�o� �#�܀%:D�0b���^Ӆ|ؒ� w� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B2'�b�&���n�7\PF����G��o�I?� �ߩ�o� �#�܀%:D�0b���^Ӆ|ؒ� w� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.032375498126639,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "e846cd4be19d096aff9d22143f1bc17ff8503411",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "14bc55fbca6429aebf1dfab59de7ca68",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00032'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd\u00017\\PF\ufffd\u0017\ufffd\u0006\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\u000b\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00032'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd\u00017\\PF\ufffd\u0017\ufffd\u0006\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\u000b\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00032'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd\u00017\\PF\ufffd\u0017\ufffd\u0006\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\u000b\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2272bd2a0dd9f7186a8fe6f0eb6d4fd059850bf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00032'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd\u00017\\PF\ufffd\u0017\ufffd\u0006\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\u000b\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB2'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd7\\PF\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00032'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd\u00017\\PF\ufffd\u0017\ufffd\u0006\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\u000b\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB2'\ufffdb\ufffd&\ufffd\ufffd\ufffdn\ufffd7\\PF\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdo\ufffdI?\ufffd \ufffd\u07e9\ufffdo\ufffd\ufffd#\ufffd\u0700%:D\ufffd0b\ufffd\ufffd\ufffd^\u04c5|\u0612\ufffd\tw\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����8-8��BgI�-Y�R��N�p�G|��^ҳ =̢蓩���0���� C����ql5�yjuW�$ � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����8-8��BgI�-Y�R��N�p�G|��^ҳ =̢蓩���0����
C����ql5�yjuW�$ � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ����8-8��BgI�-Y�R��N�p�G|��^ҳ =̢蓩���0���� C����ql5�yjuW�$ � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.002866722419888,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "ff4c81440c0b9cf49037ec4ab38b6fbf",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd\u000f-Y\ufffdR\u0015\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3\u0007 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\u0007\ufffd\u0004\ufffdql5\ufffdyjuW\ufffd$\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd\u000f-Y\ufffdR\u0015\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3\u0007 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\u0007\ufffd\u0004\ufffdql5\ufffdyjuW\ufffd$\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd\u000f-Y\ufffdR\u0015\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3\u0007 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\u0007\ufffd\u0004\ufffdql5\ufffdyjuW\ufffd$\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8165a35288d77588c2ff6c46f22408262b149f0f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd\u000f-Y\ufffdR\u0015\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3\u0007 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\u0007\ufffd\u0004\ufffdql5\ufffdyjuW\ufffd$\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd-Y\ufffdR\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\ufffd\ufffdql5\ufffdyjuW\ufffd$\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd\u000f-Y\ufffdR\u0015\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3\u0007 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\u0007\ufffd\u0004\ufffdql5\ufffdyjuW\ufffd$\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd8-8\ufffd\ufffdBgI\ufffd-Y\ufffdR\ufffd\ufffdN\ufffdp\ufffdG|\ufffd\ufffd^\u04b3 =\u0322\u84e9\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\nC\ufffd\ufffd\ufffd\ufffdql5\ufffdyjuW\ufffd$\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��v�Z��P>)T��#�J3$��F�jP��z �H���>�Y��"�j�2|�2Y�̝�詡�P � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��v�Z��P>)T��#�J3$��F�jP��z �H���>�Y��"�j�2|�2Y�̝�詡�P � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��v�Z��P>)T��#�J3$��F�jP��z �H���>�Y��"�j�2|�2Y�̝�詡�P � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.964338921981673,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "6d5d6af4ba41d053ac1e014d5f6bad3a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u0006\ufffdZ\ufffd\b\ufffd\u0012P>)T\ufffd\ufffd#\ufffdJ\u000f3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz\u0019\u001d \ufffd\u000f\u0011H\ufffd\u0007\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd\u001b2Y\ufffd\u031d\ufffd\u8a61\ufffdP\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u0006\ufffdZ\ufffd\b\ufffd\u0012P>)T\ufffd\ufffd#\ufffdJ\u000f3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz\u0019\u001d \ufffd\u000f\u0011H\ufffd\u0007\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd\u001b2Y\ufffd\u031d\ufffd\u8a61\ufffdP\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u0006\ufffdZ\ufffd\b\ufffd\u0012P>)T\ufffd\ufffd#\ufffdJ\u000f3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz\u0019\u001d \ufffd\u000f\u0011H\ufffd\u0007\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd\u001b2Y\ufffd\u031d\ufffd\u8a61\ufffdP\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62039309da307be97dc1679dadb443501d84ce21",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u0006\ufffdZ\ufffd\b\ufffd\u0012P>)T\ufffd\ufffd#\ufffdJ\u000f3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz\u0019\u001d \ufffd\u000f\u0011H\ufffd\u0007\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd\u001b2Y\ufffd\u031d\ufffd\u8a61\ufffdP\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdZ\ufffd\ufffdP>)T\ufffd\ufffd#\ufffdJ3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz \ufffdH\ufffd\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd2Y\ufffd\u031d\ufffd\u8a61\ufffdP\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u0006\ufffdZ\ufffd\b\ufffd\u0012P>)T\ufffd\ufffd#\ufffdJ\u000f3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz\u0019\u001d \ufffd\u000f\u0011H\ufffd\u0007\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd\u001b2Y\ufffd\u031d\ufffd\u8a61\ufffdP\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdZ\ufffd\ufffdP>)T\ufffd\ufffd#\ufffdJ3$\ufffd\ufffdF\ufffdjP\ufffd\ufffdz \ufffdH\ufffd\ufffd\ufffd>\ufffdY\ufffd\ufffd\"\ufffdj\ufffd2|\ufffd2Y\ufffd\u031d\ufffd\u8a61\ufffdP\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
Payload
��N>�\ �F �" �k6�)����ߤ@�Kb ��i�Q�� 5�@��yLB9��}�#�d � >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��N>�\
�F �"
�k6�)����ߤ@�Kb ��i�Q�� 5�@��yLB9��}�#�d � >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��N>�\ �F �" �k6�)����ߤ@�Kb ��i�Q�� 5�@��yLB9��}�#�d � >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.972608224270919,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9e2d45c0f735691763c6bb9a490112d677b33dc",
"event_fingerprint": "ed4da39dbfd6bd869dcf33c40bc3768fc30a9388",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "e608b01b542248142bddb76c57dc846c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN>\ufffd\\\r\ufffdF\u0011\u001f\ufffd\"\u000e\r\ufffdk6\ufffd)\u0010\ufffd\ufffd\ufffd\ufffd\u07e4@\u0016\ufffdKb \ufffd\ufffd\u0019i\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\u0018\ufffd}\ufffd#\ufffdd \ufffd\u0003\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN>\ufffd\\\r\ufffdF\u0011\u001f\ufffd\"\u000e\r\ufffdk6\ufffd)\u0010\ufffd\ufffd\ufffd\ufffd\u07e4@\u0016\ufffdKb \ufffd\ufffd\u0019i\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\u0018\ufffd}\ufffd#\ufffdd \ufffd\u0003\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN>\ufffd\\\r\ufffdF\u0011\u001f\ufffd\"\u000e\r\ufffdk6\ufffd)\u0010\ufffd\ufffd\ufffd\ufffd\u07e4@\u0016\ufffdKb \ufffd\ufffd\u0019i\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\u0018\ufffd}\ufffd#\ufffdd \ufffd\u0003\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc9052a25050068d1242e410a99830d098fc6bf7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN>\ufffd\\\r\ufffdF\u0011\u001f\ufffd\"\u000e\r\ufffdk6\ufffd)\u0010\ufffd\ufffd\ufffd\ufffd\u07e4@\u0016\ufffdKb \ufffd\ufffd\u0019i\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\u0018\ufffd}\ufffd#\ufffdd \ufffd\u0003\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdN>\ufffd\\\r\ufffdF\ufffd\"\r\ufffdk6\ufffd)\ufffd\ufffd\ufffd\ufffd\u07e4@\ufffdKb \ufffd\ufffdi\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\ufffd}\ufffd#\ufffdd \ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN>\ufffd\\\r\ufffdF\u0011\u001f\ufffd\"\u000e\r\ufffdk6\ufffd)\u0010\ufffd\ufffd\ufffd\ufffd\u07e4@\u0016\ufffdKb \ufffd\ufffd\u0019i\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\u0018\ufffd}\ufffd#\ufffdd \ufffd\u0003\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN>\ufffd\\\r\ufffdF\ufffd\"\r\ufffdk6\ufffd)\ufffd\ufffd\ufffd\ufffd\u07e4@\ufffdKb \ufffd\ufffdi\ufffdQ\ufffd\ufffd\t5\ufffd\u009b@\ufffd\ufffdyLB9\ufffd\ufffd}\ufffd#\ufffdd \ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �gMJ�e����3�� ��67Q!R����n� ���j=z�tq�����%<��#�:�7|��EB � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �gMJ�e����3�� ��67Q!R����n� ���j=z�tq�����%<��#�:�7|��EB � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �gMJ�e����3�� ��67Q!R����n� ���j=z�tq�����%<��#�:�7|��EB � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.973233482604078,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "a83cc5cda8b273bd6555b4131ceb1ac8355079b8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "a241e79912c79f63d1b66e265db51bc1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003gMJ\ufffde\ufffd\u0001\ufffd\ufffd\u0013\ufffd3\ufffd\u0015\ufffd\u000b\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\u001a\u0012\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdt\bq\ufffd\ufffd\ufffd\ufffd\ufffd%\u0006<\ufffd\ufffd#\ufffd:\ufffd7\b|\ufffd\ufffdEB\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003gMJ\ufffde\ufffd\u0001\ufffd\ufffd\u0013\ufffd3\ufffd\u0015\ufffd\u000b\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\u001a\u0012\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdt\bq\ufffd\ufffd\ufffd\ufffd\ufffd%\u0006<\ufffd\ufffd#\ufffd:\ufffd7\b|\ufffd\ufffdEB\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003gMJ\ufffde\ufffd\u0001\ufffd\ufffd\u0013\ufffd3\ufffd\u0015\ufffd\u000b\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\u001a\u0012\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdt\bq\ufffd\ufffd\ufffd\ufffd\ufffd%\u0006<\ufffd\ufffd#\ufffd:\ufffd7\b|\ufffd\ufffdEB\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efaf071f8692434492f9db5fb079509ed1b47081",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003gMJ\ufffde\ufffd\u0001\ufffd\ufffd\u0013\ufffd3\ufffd\u0015\ufffd\u000b\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\u001a\u0012\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdt\bq\ufffd\ufffd\ufffd\ufffd\ufffd%\u0006<\ufffd\ufffd#\ufffd:\ufffd7\b|\ufffd\ufffdEB\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdgMJ\ufffde\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdtq\ufffd\ufffd\ufffd\ufffd\ufffd%<\ufffd\ufffd#\ufffd:\ufffd7|\ufffd\ufffdEB\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003gMJ\ufffde\ufffd\u0001\ufffd\ufffd\u0013\ufffd3\ufffd\u0015\ufffd\u000b\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\u001a\u0012\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdt\bq\ufffd\ufffd\ufffd\ufffd\ufffd%\u0006<\ufffd\ufffd#\ufffd:\ufffd7\b|\ufffd\ufffdEB\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdgMJ\ufffde\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd67Q!R\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd\ufffd\ufffdj=z\ufffdtq\ufffd\ufffd\ufffd\ufffd\ufffd%<\ufffd\ufffd#\ufffd:\ufffd7|\ufffd\ufffdEB\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 2234317bb719fccc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��QJ�Mr;y�lO"hg�~�3�Y�� }���J� � ���#��:�u�d�}*R�( �!7���1�5 �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��QJ�Mr;y�lO"hg�~�3�Y�� }���J� � ���#��:�u�d�}*R�( �!7���1�5 �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��QJ�Mr;y�lO"hg�~�3�Y�� }���J� � ���#��:�u�d�}*R�( �!7���1�5 �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "2234317bb719fccc1170e1f492616d0b",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.044579033978498,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "61d3277701950797d97c29ae57543ef11872c74a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2234317bb719fccc1170e1f492616d0b",
"payload_hash": "09ae5ce7241ee46b283f79e4ec18bc53",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd\u001e}\ufffd\ufffd\ufffd\u0018J\ufffd \ufffd\u001c\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*\u0001R\ufffd(\u000e\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd\u001e}\ufffd\ufffd\ufffd\u0018J\ufffd \ufffd\u001c\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*\u0001R\ufffd(\u000e\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd\u001e}\ufffd\ufffd\ufffd\u0018J\ufffd \ufffd\u001c\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*\u0001R\ufffd(\u000e\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "089ff9c3ecb073cc3528b5bd4bf4e03fafb5d491",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd\u001e}\ufffd\ufffd\ufffd\u0018J\ufffd \ufffd\u001c\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*\u0001R\ufffd(\u000e\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "2234317bb719fccc1170e1f492616d0b",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd}\ufffd\ufffd\ufffdJ\ufffd \ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*R\ufffd(\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd\u001e}\ufffd\ufffd\ufffd\u0018J\ufffd \ufffd\u001c\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*\u0001R\ufffd(\u000e\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "2234317bb719fccc1170e1f492616d0b",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdQJ\ufffdMr;y\ufffdlO\"hg\ufffd~\ufffd3\ufffdY\ufffd\ufffd}\ufffd\ufffd\ufffdJ\ufffd \ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd:\ufffdu\ufffdd\ufffd}*R\ufffd(\t\ufffd!7\ufffd\ufffd\ufffd1\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��~�T�n�Ͷ=�:�����Ȑ���!�!�wY�;� 6Ud��H9�Y�r��5��OQ��bo��y�� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��~�T�n�Ͷ=�:�����Ȑ���!�!�wY�;� 6Ud��H9�Y�r��5��OQ��bo��y�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��~�T�n�Ͷ=�:�����Ȑ���!�!�wY�;� 6Ud��H9�Y�r��5��OQ��bo��y�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.008032409242632,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "f33a537e02bffc6cf32120462d15f2bb",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffdT\ufffdn\ufffd\u0376=\u0002\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\u0001\ufffdH9\u0004\ufffdY\ufffdr\u0015\ufffd\ufffd5\ufffd\u000f\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffdT\ufffdn\ufffd\u0376=\u0002\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\u0001\ufffdH9\u0004\ufffdY\ufffdr\u0015\ufffd\ufffd5\ufffd\u000f\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffdT\ufffdn\ufffd\u0376=\u0002\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\u0001\ufffdH9\u0004\ufffdY\ufffdr\u0015\ufffd\ufffd5\ufffd\u000f\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "18be9e90b1c50ca75b6e1f7b38494dd8273b7de0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffdT\ufffdn\ufffd\u0376=\u0002\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\u0001\ufffdH9\u0004\ufffdY\ufffdr\u0015\ufffd\ufffd5\ufffd\u000f\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd~\ufffdT\ufffdn\ufffd\u0376=\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\ufffdH9\ufffdY\ufffdr\ufffd\ufffd5\ufffd\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffdT\ufffdn\ufffd\u0376=\u0002\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\u0001\ufffdH9\u0004\ufffdY\ufffdr\u0015\ufffd\ufffd5\ufffd\u000f\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd~\ufffdT\ufffdn\ufffd\u0376=\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\u0210\ufffd\ufffd\ufffd!\ufffd!\ufffdwY\ufffd;\ufffd 6Ud\ufffd\ufffdH9\ufffdY\ufffdr\ufffd\ufffd5\ufffd\ufffdOQ\ufffd\ufffdbo\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��7rpA���%\ ��)Ğ��GX�)��oè � �fd�6j\I a�\�c�Cp������ ��Զ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��7rpA���%\ ��)Ğ��GX�)��oè � �fd�6j\I a�\�c�Cp������
��Զ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��7rpA���%\ ��)Ğ��GX�)��oè � �fd�6j\I a�\�c�Cp������ ��Զ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.022682812083668,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "9dd185c8ac230c08ae622a4d82b0c8f78cdd3665",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "d0f2e054468e0b48d9eaed6233f60e0e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd7rpA\ufffd\u0013\ufffd\ufffd%\\ \ufffd\ufffd\u0018)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\u000b\ufffd\u0016 \ufffdfd\ufffd6j\u000f\\I\t\u0003a\ufffd\\\ufffd\u0007c\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd7rpA\ufffd\u0013\ufffd\ufffd%\\ \ufffd\ufffd\u0018)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\u000b\ufffd\u0016 \ufffdfd\ufffd6j\u000f\\I\t\u0003a\ufffd\\\ufffd\u0007c\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd7rpA\ufffd\u0013\ufffd\ufffd%\\ \ufffd\ufffd\u0018)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\u000b\ufffd\u0016 \ufffdfd\ufffd6j\u000f\\I\t\u0003a\ufffd\\\ufffd\u0007c\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3fa332ac17ad6422b0ae7ebcc7e4b45843a9190",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd7rpA\ufffd\u0013\ufffd\ufffd%\\ \ufffd\ufffd\u0018)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\u000b\ufffd\u0016 \ufffdfd\ufffd6j\u000f\\I\t\u0003a\ufffd\\\ufffd\u0007c\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd7rpA\ufffd\ufffd\ufffd%\\ \ufffd\ufffd)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\ufffd \ufffdfd\ufffd6j\\I\ta\ufffd\\\ufffdc\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd7rpA\ufffd\u0013\ufffd\ufffd%\\ \ufffd\ufffd\u0018)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\u000b\ufffd\u0016 \ufffdfd\ufffd6j\u000f\\I\t\u0003a\ufffd\\\ufffd\u0007c\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd7rpA\ufffd\ufffd\ufffd%\\ \ufffd\ufffd)\u011e\ufffd\ufffdGX\ufffd)\ufffd\ufffdo\u00e8\ufffd \ufffdfd\ufffd6j\\I\ta\ufffd\\\ufffdc\ufffdCp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\u0536\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��4hm��.%�!m1�)z�f?-�a�ML�6 �� ��4i�J�%ƢLF�G�<��̞n� ��0|Zu%� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��4hm��.%�!m1�)z�f?-�a�ML�6 �� ��4i�J�%ƢLF�G�<��̞n�
��0|Zu%� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��4hm��.%�!m1�)z�f?-�a�ML�6 �� ��4i�J�%ƢLF�G�<��̞n� ��0|Zu%� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.941921297602579,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "e2e49e84a264b43205f48172ef51f672",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd4hm\ufffd\ufffd.%\ufffd!m\u00031\ufffd)z\ufffdf?-\ufffda\ufffdML\u0010\ufffd6\u0000\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd\u0006<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd4hm\ufffd\ufffd.%\ufffd!m\u00031\ufffd)z\ufffdf?-\ufffda\ufffdML\u0010\ufffd6\u0000\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd\u0006<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd4hm\ufffd\ufffd.%\ufffd!m\u00031\ufffd)z\ufffdf?-\ufffda\ufffdML\u0010\ufffd6\u0000\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd\u0006<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "924932d03116e0c0a4fd234fe88127aa5d107ab2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd4hm\ufffd\ufffd.%\ufffd!m\u00031\ufffd)z\ufffdf?-\ufffda\ufffdML\u0010\ufffd6\u0000\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd\u0006<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd4hm\ufffd\ufffd.%\ufffd!m1\ufffd)z\ufffdf?-\ufffda\ufffdML\ufffd6\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd4hm\ufffd\ufffd.%\ufffd!m\u00031\ufffd)z\ufffdf?-\ufffda\ufffdML\u0010\ufffd6\u0000\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd\u0006<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd4hm\ufffd\ufffd.%\ufffd!m1\ufffd)z\ufffdf?-\ufffda\ufffdML\ufffd6\ufffd\ufffd \ufffd\ufffd4i\ufffdJ\ufffd%\u01a2LF\ufffdG\ufffd<\ufffd\ufffd\u031en\ufffd\r\ufffd\ufffd0|Zu%\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 02d5c2094446ec94 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����~��٘�$�o�Ą��,~Y,�@�� � (�6Ge�j_��-�ޜ ���l%؞�� ��� �����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����~��٘�$�o�Ą��,~Y,�@�� � (�6Ge�j_��-�ޜ ���l%؞�� ��� �����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ����~��٘�$�o�Ą��,~Y,�@�� � (�6Ge�j_��-�ޜ ���l%؞�� ��� �����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �jj 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "02d5c2094446ec94e9eb4254837e3b1b",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.019614853476508,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "766623d52f196e60592e6b7078d70ac7337f5fff",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "02d5c2094446ec94e9eb4254837e3b1b",
"payload_hash": "b845859820ad5abf9be1ecd89a2b5641",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\u0014\ufffd$\ufffd\u000fo\u0017\ufffd\u0104\ufffd\ufffd,~\u000eY,\ufffd@\ufffd\u001b\ufffd \ufffd\u001f(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\u000b\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\u0014\ufffd$\ufffd\u000fo\u0017\ufffd\u0104\ufffd\ufffd,~\u000eY,\ufffd@\ufffd\u001b\ufffd \ufffd\u001f(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\u000b\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdjj\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\u0014\ufffd$\ufffd\u000fo\u0017\ufffd\u0104\ufffd\ufffd,~\u000eY,\ufffd@\ufffd\u001b\ufffd \ufffd\u001f(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\u000b\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70857eff52e734c7fb1fc594fff8d9ccbecb2ff0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\u0014\ufffd$\ufffd\u000fo\u0017\ufffd\u0104\ufffd\ufffd,~\u000eY,\ufffd@\ufffd\u001b\ufffd \ufffd\u001f(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\u000b\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "02d5c2094446ec94e9eb4254837e3b1b",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\ufffd$\ufffdo\ufffd\u0104\ufffd\ufffd,~Y,\ufffd@\ufffd\ufffd \ufffd(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\u0014\ufffd$\ufffd\u000fo\u0017\ufffd\u0104\ufffd\ufffd,~\u000eY,\ufffd@\ufffd\u001b\ufffd \ufffd\u001f(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\u000b\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "02d5c2094446ec94e9eb4254837e3b1b",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\u0658\ufffd$\ufffdo\ufffd\u0104\ufffd\ufffd,~Y,\ufffd@\ufffd\ufffd \ufffd(\ufffd6Ge\ufffdj_\ufffd\ufffd-\ufffd\u079c\ufffd\ufffd\ufffdl%\u061e\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P��ݶ&o����$�1�MZ���R։�k���� �-�ۍ�� &N�J=1#�l�#�鹇r��*� F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P��ݶ&o����$�1�MZ���R։�k���� �-�ۍ�� &N�J=1#�l�#�鹇r��*� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P��ݶ&o����$�1�MZ���R։�k���� �-�ۍ�� &N�J=1#�l�#�鹇r��*� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.108894516218521,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "6dd661685edeca9b437b4575e3bc0c9c11076466",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "a713a202698ed03c6ed5802fdf5f8652",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\u0015\u0776&\u0005o\ufffd\ufffd\ufffd\ufffd$\u0003\u000f\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd\u0013-\ufffd\u06cd\ufffd\ufffd\u001c&N\ufffdJ=1#\ufffdl\u001a\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffd\u000e\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\u0015\u0776&\u0005o\ufffd\ufffd\ufffd\ufffd$\u0003\u000f\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd\u0013-\ufffd\u06cd\ufffd\ufffd\u001c&N\ufffdJ=1#\ufffdl\u001a\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffd\u000e\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\u0015\u0776&\u0005o\ufffd\ufffd\ufffd\ufffd$\u0003\u000f\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd\u0013-\ufffd\u06cd\ufffd\ufffd\u001c&N\ufffdJ=1#\ufffdl\u001a\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffd\u000e\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b72cf4be869246908832f70f8139e3815011ee0a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\u0015\u0776&\u0005o\ufffd\ufffd\ufffd\ufffd$\u0003\u000f\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd\u0013-\ufffd\u06cd\ufffd\ufffd\u001c&N\ufffdJ=1#\ufffdl\u001a\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffd\u000e\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\ufffd\ufffd\u0776&o\ufffd\ufffd\ufffd\ufffd$\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd-\ufffd\u06cd\ufffd\ufffd&N\ufffdJ=1#\ufffdl\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\u0015\u0776&\u0005o\ufffd\ufffd\ufffd\ufffd$\u0003\u000f\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd\u0013-\ufffd\u06cd\ufffd\ufffd\u001c&N\ufffdJ=1#\ufffdl\u001a\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffd\u000e\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd\ufffd\u0776&o\ufffd\ufffd\ufffd\ufffd$\ufffd1\ufffdMZ\ufffd\ufffd\ufffdR\u0589\ufffdk\ufffd\ufffd\ufffd\ufffd \ufffd-\ufffd\u06cd\ufffd\ufffd&N\ufffdJ=1#\ufffdl\ufffd#\ufffd\u9e47r\ufffd\ufffd*\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B{4!����$+Z�������t�g��l�U� ���x2c�� ڊr�� E �<3� � D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B{4!����$+Z�������t�g��l�U� ���x2c�� ڊr�� E �<3� � D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B{4!����$+Z�������t�g��l�U� ���x2c�� ڊr�� E �<3� � D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.9516199528028535,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "e846cd4be19d096aff9d22143f1bc17ff8503411",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "938ae4b2ec3a019f245b50425bfed6d4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\u0012{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\u001at\ufffdg\u0015\ufffd\ufffdl\ufffdU\ufffd\u0012 \ufffd\ufffd\ufffd\u0017\u0014x\u00142c\u0018\ufffd\ufffd\u001f\u068a\u0012\u0004\u0007r\ufffd\ufffd\u0000E\u0014 \ufffd<3\ufffd\u001d\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\u0012{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\u001at\ufffdg\u0015\ufffd\ufffdl\ufffdU\ufffd\u0012 \ufffd\ufffd\ufffd\u0017\u0014x\u00142c\u0018\ufffd\ufffd\u001f\u068a\u0012\u0004\u0007r\ufffd\ufffd\u0000E\u0014 \ufffd<3\ufffd\u001d\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\u0012{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\u001at\ufffdg\u0015\ufffd\ufffdl\ufffdU\ufffd\u0012 \ufffd\ufffd\ufffd\u0017\u0014x\u00142c\u0018\ufffd\ufffd\u001f\u068a\u0012\u0004\u0007r\ufffd\ufffd\u0000E\u0014 \ufffd<3\ufffd\u001d\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17c6f2e9ea33563bde8597822fdd6a52364ebb19",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\u0012{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\u001at\ufffdg\u0015\ufffd\ufffdl\ufffdU\ufffd\u0012 \ufffd\ufffd\ufffd\u0017\u0014x\u00142c\u0018\ufffd\ufffd\u001f\u068a\u0012\u0004\u0007r\ufffd\ufffd\u0000E\u0014 \ufffd<3\ufffd\u001d\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffdg\ufffd\ufffdl\ufffdU\ufffd \ufffd\ufffd\ufffdx2c\ufffd\ufffd\u068ar\ufffd\ufffdE \ufffd<3\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\u0012{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\u001at\ufffdg\u0015\ufffd\ufffdl\ufffdU\ufffd\u0012 \ufffd\ufffd\ufffd\u0017\u0014x\u00142c\u0018\ufffd\ufffd\u001f\u068a\u0012\u0004\u0007r\ufffd\ufffd\u0000E\u0014 \ufffd<3\ufffd\u001d\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB{4!\ufffd\ufffd\ufffd\ufffd$+Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffdg\ufffd\ufffdl\ufffdU\ufffd \ufffd\ufffd\ufffdx2c\ufffd\ufffd\u068ar\ufffd\ufffdE \ufffd<3\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �/�� �,:�A��;�=E�n�3�5M�F1 �%X��FQ"����|�'��Su}�� �(e��� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/�� �,:�A��;�=E�n�3�5M�F1 �%X��FQ"����|�'��Su}�� �(e��� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �/�� �,:�A��;�=E�n�3�5M�F1 �%X��FQ"����|�'��Su}�� �(e��� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.00903519822103,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "05d642bd7b58d373de93c738ffd3fc80",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/\u0007\u0002\ufffd\ufffd\u001e\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd\u00015M\ufffdF1 \ufffd%X\ufffd\u0010\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd\u001c \ufffd(e\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/\u0007\u0002\ufffd\ufffd\u001e\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd\u00015M\ufffdF1 \ufffd%X\ufffd\u0010\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd\u001c \ufffd(e\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/\u0007\u0002\ufffd\ufffd\u001e\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd\u00015M\ufffdF1 \ufffd%X\ufffd\u0010\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd\u001c \ufffd(e\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5efe1afa032367ceb7795bcf308d2733da134aa4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/\u0007\u0002\ufffd\ufffd\u001e\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd\u00015M\ufffdF1 \ufffd%X\ufffd\u0010\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd\u001c \ufffd(e\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd5M\ufffdF1 \ufffd%X\ufffd\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd \ufffd(e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/\u0007\u0002\ufffd\ufffd\u001e\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd\u00015M\ufffdF1 \ufffd%X\ufffd\u0010\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd\u001c \ufffd(e\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\ufffd,:\ufffdA\ufffd\ufffd;\ufffd=E\ufffdn\ufffd3\ufffd5M\ufffdF1 \ufffd%X\ufffd\ufffdFQ\"\ufffd\ufffd\ufffd\ufffd|\ufffd'\ufffd\ufffdSu}\ufffd\ufffd \ufffd(e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ������r::�s�_�-B�����?Id0 /<� W5bz�@9 ;C|g< ���MZ��P�~� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������r::�s�_�-B�����?Id0 /<�
W5bz�@9 ;C|g< ���MZ��P�~� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ������r::�s�_�-B�����?Id0 /<� W5bz�@9 ;C|g< ���MZ��P�~� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.969916985453229,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "15439791c5a14b042b2e70f0dc76d94e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffdr::\ufffds\ufffd_\u000e\u0011\ufffd-\u0003B\ufffd\ufffd\u001a\ufffd\ufffd\ufffd?I\u0001\u0014d0 \/<\ufffd\rW5bz\ufffd@9\f;C|\u0014g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffdr::\ufffds\ufffd_\u000e\u0011\ufffd-\u0003B\ufffd\ufffd\u001a\ufffd\ufffd\ufffd?I\u0001\u0014d0 \/<\ufffd\rW5bz\ufffd@9\f;C|\u0014g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffdr::\ufffds\ufffd_\u000e\u0011\ufffd-\u0003B\ufffd\ufffd\u001a\ufffd\ufffd\ufffd?I\u0001\u0014d0 \/<\ufffd\rW5bz\ufffd@9\f;C|\u0014g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a937550f2c9e4c25b7b3fa59f4bc8d4cb38a8af",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffdr::\ufffds\ufffd_\u000e\u0011\ufffd-\u0003B\ufffd\ufffd\u001a\ufffd\ufffd\ufffd?I\u0001\u0014d0 \/<\ufffd\rW5bz\ufffd@9\f;C|\u0014g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr::\ufffds\ufffd_\ufffd-B\ufffd\ufffd\ufffd\ufffd\ufffd?Id0 \/<\ufffd\rW5bz\ufffd@9;C|g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffdr::\ufffds\ufffd_\u000e\u0011\ufffd-\u0003B\ufffd\ufffd\u001a\ufffd\ufffd\ufffd?I\u0001\u0014d0 \/<\ufffd\rW5bz\ufffd@9\f;C|\u0014g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr::\ufffds\ufffd_\ufffd-B\ufffd\ufffd\ufffd\ufffd\ufffd?Id0 \/<\ufffd\rW5bz\ufffd@9;C|g<\t\ufffd\ufffd\ufffdMZ\ufffd\ufffdP\ufffd~\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
Payload
��:e�+.g�qR��5dJԮ_�E~+n ��r�� ��M �IIaC�-��S��.p'�����u�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��:e�+.g�qR��5dJԮ_�E~+n ��r�� ��M �IIaC�-��S��.p'�����u�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��:e�+.g�qR��5dJԮ_�E~+n ��r�� ��M �IIaC�-��S��.p'�����u�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9498450005860195,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9e2d45c0f735691763c6bb9a490112d677b33dc",
"event_fingerprint": "ed4da39dbfd6bd869dcf33c40bc3768fc30a9388",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "2df95ff06993629c0aef95a83511506c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u0018\u052e_\ufffdE~+n \ufffd\ufffdr\u0019\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\u0003\ufffd\ufffdS\ufffd\u0013\ufffd.p'\ufffd\u000f\ufffd\ufffd\ufffd\ufffdu\u0014\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u0018\u052e_\ufffdE~+n \ufffd\ufffdr\u0019\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\u0003\ufffd\ufffdS\ufffd\u0013\ufffd.p'\ufffd\u000f\ufffd\ufffd\ufffd\ufffdu\u0014\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u0018\u052e_\ufffdE~+n \ufffd\ufffdr\u0019\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\u0003\ufffd\ufffdS\ufffd\u0013\ufffd.p'\ufffd\u000f\ufffd\ufffd\ufffd\ufffdu\u0014\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73540d571d21eacdc35d67988ea421260221bb22",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u0018\u052e_\ufffdE~+n \ufffd\ufffdr\u0019\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\u0003\ufffd\ufffdS\ufffd\u0013\ufffd.p'\ufffd\u000f\ufffd\ufffd\ufffd\ufffdu\u0014\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u052e_\ufffdE~+n \ufffd\ufffdr\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\ufffd\ufffdS\ufffd\ufffd.p'\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u0018\u052e_\ufffdE~+n \ufffd\ufffdr\u0019\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\u0003\ufffd\ufffdS\ufffd\u0013\ufffd.p'\ufffd\u000f\ufffd\ufffd\ufffd\ufffdu\u0014\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd:e\ufffd+.g\ufffdqR\ufffd\ufffd5dJ\u052e_\ufffdE~+n \ufffd\ufffdr\ufffd\ufffd \ufffd\ufffdM \ufffdIIaC\ufffd-\ufffd\ufffdS\ufffd\ufffd.p'\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 bbf51f465397edb6 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��K� ��rjh �@B��e3�,4�4mφD]�"� �&�^n�H��bQ�mk�� �e �H��&��x � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��K� ��rjh �@B��e3�,4�4mφD]�"� �&�^n�H��bQ�mk��
�e �H��&��x �
����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��K� ��rjh �@B��e3�,4�4mφD]�"� �&�^n�H��bQ�mk�� �e �H��&��x � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ٚ� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "bbf51f465397edb6de00defb4c4118da",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.962659928710445,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "65df9f5610deac6765ad1e8db98414397c3bb7e2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "bbf51f465397edb6de00defb4c4118da",
"payload_hash": "9aef5a488b055ba2610c3a9a0e348b4d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdK\ufffd\f\u0002\ufffd\u0001\ufffdrjh\u001f\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\u0016\ufffdmk\ufffd\ufffd\r\ufffde\u000b\ufffdH\ufffd\u0015\u0016\ufffd&\ufffd\ufffdx\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdK\ufffd\f\u0002\ufffd\u0001\ufffdrjh\u001f\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\u0016\ufffdmk\ufffd\ufffd\r\ufffde\u000b\ufffdH\ufffd\u0015\u0016\ufffd&\ufffd\ufffdx\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u065a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdK\ufffd\f\u0002\ufffd\u0001\ufffdrjh\u001f\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\u0016\ufffdmk\ufffd\ufffd\r\ufffde\u000b\ufffdH\ufffd\u0015\u0016\ufffd&\ufffd\ufffdx\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58b741845c9c438aaf07e40cf1876c5d2e2e118c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdK\ufffd\f\u0002\ufffd\u0001\ufffdrjh\u001f\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\u0016\ufffdmk\ufffd\ufffd\r\ufffde\u000b\ufffdH\ufffd\u0015\u0016\ufffd&\ufffd\ufffdx\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "bbf51f465397edb6de00defb4c4118da",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffdrjh\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\ufffdmk\ufffd\ufffd\r\ufffde\ufffdH\ufffd\ufffd&\ufffd\ufffdx\ufffd\n\n\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdK\ufffd\f\u0002\ufffd\u0001\ufffdrjh\u001f\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\u0016\ufffdmk\ufffd\ufffd\r\ufffde\u000b\ufffdH\ufffd\u0015\u0016\ufffd&\ufffd\ufffdx\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "bbf51f465397edb6de00defb4c4118da",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffdrjh\ufffd@B\ufffd\ufffde3\ufffd,4\ufffd4m\u03c6D]\ufffd\"\ufffd \ufffd&\ufffd^n\ufffdH\ufffd\ufffdbQ\ufffdmk\ufffd\ufffd\r\ufffde\ufffdH\ufffd\ufffd&\ufffd\ufffdx\ufffd\n\n\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��e&!c�7�%l��Z;j\6��=�} `@1�" �2r6$��5!�� 0���Տ�<��n8�l�� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��e&!c�7�%l��Z;j\6��=�} `@1�" �2r6$��5!�� 0���Տ�<��n8�l�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��e&!c�7�%l��Z;j\6��=�} `@1�" �2r6$��5!�� 0���Տ�<��n8�l�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.979600167354033,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "48e2b2833c632cf7cd6b3a47c3b2a787",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd\u0018=\u0003\ufffd}\u001e`@1\ufffd\"\u0011\u0018 \ufffd2r6$\ufffd\ufffd5!\ufffd\u000f\ufffd\u000b0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn\u00058\ufffdl\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd\u0018=\u0003\ufffd}\u001e`@1\ufffd\"\u0011\u0018 \ufffd2r6$\ufffd\ufffd5!\ufffd\u000f\ufffd\u000b0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn\u00058\ufffdl\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd\u0018=\u0003\ufffd}\u001e`@1\ufffd\"\u0011\u0018 \ufffd2r6$\ufffd\ufffd5!\ufffd\u000f\ufffd\u000b0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn\u00058\ufffdl\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06bac0e427ee7711a75984ddb5b44f2e96fded8e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd\u0018=\u0003\ufffd}\u001e`@1\ufffd\"\u0011\u0018 \ufffd2r6$\ufffd\ufffd5!\ufffd\u000f\ufffd\u000b0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn\u00058\ufffdl\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd=\ufffd}`@1\ufffd\" \ufffd2r6$\ufffd\ufffd5!\ufffd\ufffd0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn8\ufffdl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd\u0018=\u0003\ufffd}\u001e`@1\ufffd\"\u0011\u0018 \ufffd2r6$\ufffd\ufffd5!\ufffd\u000f\ufffd\u000b0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn\u00058\ufffdl\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffde&!c\ufffd7\ufffd%l\ufffd\ufffdZ;j\\6\ufffd\ufffd=\ufffd}`@1\ufffd\" \ufffd2r6$\ufffd\ufffd5!\ufffd\ufffd0\ufffd\ufffd\ufffd\u054f\ufffd<\ufffd\ufffdn8\ufffdl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �ɨ= ���痌$��H��]��O��\��_�WG�s BtI ����o *� ��.г6�W�����4a � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ɨ= ���痌$��H��]��O��\��_�WG�s BtI ����o
*�
��.г6�W�����4a � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �ɨ= ���痌$��H��]��O��\��_�WG�s BtI ����o *� ��.г6�W�����4a � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.00238525025798,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "a83cc5cda8b273bd6555b4131ceb1ac8355079b8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "67f12e1a31210846fd60da327cb93654",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0268=\u0000\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\u0016\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\u001e\ufffd\ufffd\u001b\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u0433\u00076\ufffd\u0003W\ufffd\ufffd\ufffd\u0004\ufffd\ufffd4a\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0268=\u0000\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\u0016\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\u001e\ufffd\ufffd\u001b\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u0433\u00076\ufffd\u0003W\ufffd\ufffd\ufffd\u0004\ufffd\ufffd4a\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0268=\u0000\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\u0016\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\u001e\ufffd\ufffd\u001b\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u0433\u00076\ufffd\u0003W\ufffd\ufffd\ufffd\u0004\ufffd\ufffd4a\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ed25bdbdadc5f014d4b6245d6b8d0da3d4e45c7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0268=\u0000\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\u0016\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\u001e\ufffd\ufffd\u001b\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u0433\u00076\ufffd\u0003W\ufffd\ufffd\ufffd\u0004\ufffd\ufffd4a\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0268=\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\ufffd\ufffd\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u04336\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd4a\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0268=\u0000\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\u0016\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\u001e\ufffd\ufffd\u001b\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u0433\u00076\ufffd\u0003W\ufffd\ufffd\ufffd\u0004\ufffd\ufffd4a\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0268=\ufffd\ufffd\ufffd\u75cc$\ufffd\ufffdH\ufffd\ufffd]\ufffd\ufffdO\ufffd\ufffd\\\ufffd\ufffd_\ufffdWG\ufffds BtI\ufffd\ufffd\ufffd\ufffdo\n*\ufffd\r\ufffd\ufffd.\u04336\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd4a\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��8��A'�rŮ> ��� ����� �� R�0�P �����;������{e3f^��ޔ�8��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��8��A'�rŮ> ��� ����� �� R�0�P �����;������{e3f^��ޔ�8��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��8��A'�rŮ> ��� ����� �� R�0�P �����;������{e3f^��ޔ�8��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.025530083425208,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "a9b53beaed70002db22362116c4a81d3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8\ufffd\b\ufffdA'\ufffdr\u016e>\f\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u001e\ufffd\ufffd R\ufffd0\ufffdP \u001e\ufffd\ufffd\ufffd\ufffd\ufffd\u000e;\u0014\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0005{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8\ufffd\b\ufffdA'\ufffdr\u016e>\f\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u001e\ufffd\ufffd R\ufffd0\ufffdP \u001e\ufffd\ufffd\ufffd\ufffd\ufffd\u000e;\u0014\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0005{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8\ufffd\b\ufffdA'\ufffdr\u016e>\f\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u001e\ufffd\ufffd R\ufffd0\ufffdP \u001e\ufffd\ufffd\ufffd\ufffd\ufffd\u000e;\u0014\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0005{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2dca3df54ffdf04d4688c603d4b14ce50d4f09f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8\ufffd\b\ufffdA'\ufffdr\u016e>\f\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u001e\ufffd\ufffd R\ufffd0\ufffdP \u001e\ufffd\ufffd\ufffd\ufffd\ufffd\u000e;\u0014\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0005{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd8\ufffd\ufffdA'\ufffdr\u016e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd R\ufffd0\ufffdP \ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8\ufffd\b\ufffdA'\ufffdr\u016e>\f\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u001e\ufffd\ufffd R\ufffd0\ufffdP \u001e\ufffd\ufffd\ufffd\ufffd\ufffd\u000e;\u0014\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0005{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd8\ufffd\ufffdA'\ufffdr\u016e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd R\ufffd0\ufffdP \ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{e3f^\ufffd\ufffd\u0794\ufffd8\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����@�?`����Y������*<j�e�� ϫ � �̷���ep�'��5��釛��.L � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����@�?`����Y������*<j�e��
ϫ � �̷���ep�'��5��釛��.L � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����@�?`����Y������*<j�e�� ϫ � �̷���ep�'��5��釛��.L � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.001426450297343,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "9dd185c8ac230c08ae622a4d82b0c8f78cdd3665",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "f4833d8c1a0cbe37a0bcf5f8f64f9c01",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffd@\ufffd\b?`\ufffd\ufffd\ufffd\ufffdY\ufffd\u0016\ufffd\ufffd\ufffd\u0006\ufffd\u0017\ufffd*<\u0002j\ufffd\u0002e\ufffd\ufffd\r \u03eb\u001a\u0000\ufffd\u001f\u0012\ufffd\u0337\ufffd\ufffd\u0003\ufffdep\ufffd'\ufffd\u000f\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffd@\ufffd\b?`\ufffd\ufffd\ufffd\ufffdY\ufffd\u0016\ufffd\ufffd\ufffd\u0006\ufffd\u0017\ufffd*<\u0002j\ufffd\u0002e\ufffd\ufffd\r \u03eb\u001a\u0000\ufffd\u001f\u0012\ufffd\u0337\ufffd\ufffd\u0003\ufffdep\ufffd'\ufffd\u000f\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffd@\ufffd\b?`\ufffd\ufffd\ufffd\ufffdY\ufffd\u0016\ufffd\ufffd\ufffd\u0006\ufffd\u0017\ufffd*<\u0002j\ufffd\u0002e\ufffd\ufffd\r \u03eb\u001a\u0000\ufffd\u001f\u0012\ufffd\u0337\ufffd\ufffd\u0003\ufffdep\ufffd'\ufffd\u000f\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cc0decce035a6521b398f4f78ad50738051c5b6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffd@\ufffd\b?`\ufffd\ufffd\ufffd\ufffdY\ufffd\u0016\ufffd\ufffd\ufffd\u0006\ufffd\u0017\ufffd*<\u0002j\ufffd\u0002e\ufffd\ufffd\r \u03eb\u001a\u0000\ufffd\u001f\u0012\ufffd\u0337\ufffd\ufffd\u0003\ufffdep\ufffd'\ufffd\u000f\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd?`\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*<j\ufffde\ufffd\ufffd\r \u03eb\ufffd\ufffd\u0337\ufffd\ufffd\ufffdep\ufffd'\ufffd\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffd@\ufffd\b?`\ufffd\ufffd\ufffd\ufffdY\ufffd\u0016\ufffd\ufffd\ufffd\u0006\ufffd\u0017\ufffd*<\u0002j\ufffd\u0002e\ufffd\ufffd\r \u03eb\u001a\u0000\ufffd\u001f\u0012\ufffd\u0337\ufffd\ufffd\u0003\ufffdep\ufffd'\ufffd\u000f\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd?`\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*<j\ufffde\ufffd\ufffd\r \u03eb\ufffd\ufffd\u0337\ufffd\ufffd\ufffdep\ufffd'\ufffd\ufffd5\ufffd\ufffd\u91db\ufffd\ufffd.L\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�����5��xZ���A�m��V�c�� |�4�䊾U _�b�ʩ�u] �� ��e ��L�Y���� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�����5��xZ���A�m��V�c�� |�4�䊾U _�b�ʩ�u] �� ��e ��L�Y���� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�����5��xZ���A�m��V�c�� |�4�䊾U _�b�ʩ�u] �� ��e ��L�Y���� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.021793323356167,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "e846cd4be19d096aff9d22143f1bc17ff8503411",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "7cd5029c93776c3cdfa7427c14e4ce56",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd\u001d|\ufffd4\ufffd\u42beU _\ufffd\u0006b\u0006\ufffd\u02a9\ufffdu\u0012\u0003]\u0006\t\ufffd\ufffd\u001b\t\ufffd\ufffde\f\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd\u001d|\ufffd4\ufffd\u42beU _\ufffd\u0006b\u0006\ufffd\u02a9\ufffdu\u0012\u0003]\u0006\t\ufffd\ufffd\u001b\t\ufffd\ufffde\f\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd\u001d|\ufffd4\ufffd\u42beU _\ufffd\u0006b\u0006\ufffd\u02a9\ufffdu\u0012\u0003]\u0006\t\ufffd\ufffd\u001b\t\ufffd\ufffde\f\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a8b1717cfb250371c8cf530b39b3ebde7861945f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd\u001d|\ufffd4\ufffd\u42beU _\ufffd\u0006b\u0006\ufffd\u02a9\ufffdu\u0012\u0003]\u0006\t\ufffd\ufffd\u001b\t\ufffd\ufffde\f\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd|\ufffd4\ufffd\u42beU _\ufffdb\ufffd\u02a9\ufffdu]\t\ufffd\ufffd\t\ufffd\ufffde\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd\u001d|\ufffd4\ufffd\u42beU _\ufffd\u0006b\u0006\ufffd\u02a9\ufffdu\u0012\u0003]\u0006\t\ufffd\ufffd\u001b\t\ufffd\ufffde\f\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdxZ\ufffd\ufffd\ufffdA\ufffdm\ufffd\ufffdV\ufffdc\ufffd\ufffd|\ufffd4\ufffd\u42beU _\ufffdb\ufffd\u02a9\ufffdu]\t\ufffd\ufffd\t\ufffd\ufffde\ufffd\ufffdL\ufffdY\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8ac377ad00170d43 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �vj�쐂����'(WYxqX�7������� � : �D8��gC�;Vq�2EB3�/� �;��. h��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �vj�쐂����'(WYxqX�7������� � : �D8��gC�;Vq�2EB3�/�
�;��.
h��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �vj�쐂����'(WYxqX�7������� � : �D8��gC�;Vq�2EB3�/� �;��. h��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "8ac377ad00170d435e6764d43c4eaab5",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.945101904242869,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "5914503578d6bf17b6e512252ccdac2c379ca0a7",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8ac377ad00170d435e6764d43c4eaab5",
"payload_hash": "90c499d92ec3f7c109e211d78eaaae62",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003vj\ufffd\u0017\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\ufffd\u000b: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\u0013\ufffd\/\ufffd\r\b\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003vj\ufffd\u0017\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\ufffd\u000b: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\u0013\ufffd\/\ufffd\r\b\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003vj\ufffd\u0017\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\ufffd\u000b: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\u0013\ufffd\/\ufffd\r\b\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6f74de1b9b98ecc36ea833563bbc5bc59dbf585",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003vj\ufffd\u0017\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\ufffd\u000b: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\u0013\ufffd\/\ufffd\r\b\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "8ac377ad00170d435e6764d43c4eaab5",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdvj\ufffd\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\ufffd\/\ufffd\r\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003vj\ufffd\u0017\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\ufffd\u000b: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\u0013\ufffd\/\ufffd\r\b\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "8ac377ad00170d435e6764d43c4eaab5",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdvj\ufffd\uc402\ufffd\ufffd\ufffd\ufffd'(WYxqX\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffdD8\ufffd\ufffdgC\ufffd;Vq\ufffd2EB3\ufffd\/\ufffd\r\ufffd;\ufffd\ufffd.\nh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �=��z:������b�})'>�>���Hu#h�c �g�$�jqP�mi� oߛ+���%�D����E � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �=��z:������b�})'>�>���Hu#h�c
�g�$�jqP�mi� oߛ+���%�D����E � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �=��z:������b�})'>�>���Hu#h�c �g�$�jqP�mi� oߛ+���%�D����E � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.93781059452991,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "365ecd70102991f79e92bd7b4d731820",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd}\u0017)\u0019'>\ufffd>\ufffd\ufffd\u0004\ufffdHu#h\u0010\ufffdc \r\u0011\ufffdg\ufffd$\ufffd\u0013jqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffd\u000fD\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd}\u0017)\u0019'>\ufffd>\ufffd\ufffd\u0004\ufffdHu#h\u0010\ufffdc \r\u0011\ufffdg\ufffd$\ufffd\u0013jqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffd\u000fD\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd}\u0017)\u0019'>\ufffd>\ufffd\ufffd\u0004\ufffdHu#h\u0010\ufffdc \r\u0011\ufffdg\ufffd$\ufffd\u0013jqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffd\u000fD\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b51f0913a267cc1b4e8c5a679e452259f9182539",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd}\u0017)\u0019'>\ufffd>\ufffd\ufffd\u0004\ufffdHu#h\u0010\ufffdc \r\u0011\ufffdg\ufffd$\ufffd\u0013jqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffd\u000fD\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd})'>\ufffd>\ufffd\ufffd\ufffdHu#h\ufffdc \r\ufffdg\ufffd$\ufffdjqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd}\u0017)\u0019'>\ufffd>\ufffd\ufffd\u0004\ufffdHu#h\u0010\ufffdc \r\u0011\ufffdg\ufffd$\ufffd\u0013jqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffd\u000fD\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd=\ufffd\ufffdz:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd})'>\ufffd>\ufffd\ufffd\ufffdHu#h\ufffdc \r\ufffdg\ufffd$\ufffdjqP\ufffdmi\ufffd\to\u07db+\ufffd\ufffd\ufffd%\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P[0�NXg�� ��*� k e�Q� ���/�6 + @ǖ�40�zx�]؛�Ϣ Ȟ62��� F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P[0�NXg�� ��*� k
e�Q� ���/�6 + @ǖ�40�zx�]؛�Ϣ Ȟ62��� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P[0�NXg�� ��*� k e�Q� ���/�6 + @ǖ�40�zx�]؛�Ϣ Ȟ62��� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.0381027990008675,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "6dd661685edeca9b437b4575e3bc0c9c11076466",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "70575c380ae6fcbc3701a9b565749e9f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003[0\ufffdNXg\ufffd\ufffd\u001f\ufffd\ufffd*\ufffd k\n\u0004e\ufffdQ\ufffd \ufffd\ufffd\u0018\ufffd\/\ufffd6 +\u0004\u0014\u001c@\u01d6\ufffd40\ufffdz\u000ex\u0013\ufffd\u0011]\u061b\ufffd\u03e2\u001c\u021e62\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003[0\ufffdNXg\ufffd\ufffd\u001f\ufffd\ufffd*\ufffd k\n\u0004e\ufffdQ\ufffd \ufffd\ufffd\u0018\ufffd\/\ufffd6 +\u0004\u0014\u001c@\u01d6\ufffd40\ufffdz\u000ex\u0013\ufffd\u0011]\u061b\ufffd\u03e2\u001c\u021e62\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003[0\ufffdNXg\ufffd\ufffd\u001f\ufffd\ufffd*\ufffd k\n\u0004e\ufffdQ\ufffd \ufffd\ufffd\u0018\ufffd\/\ufffd6 +\u0004\u0014\u001c@\u01d6\ufffd40\ufffdz\u000ex\u0013\ufffd\u0011]\u061b\ufffd\u03e2\u001c\u021e62\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebde1f2661defc80a4582ecfc0035685ee03a480",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003[0\ufffdNXg\ufffd\ufffd\u001f\ufffd\ufffd*\ufffd k\n\u0004e\ufffdQ\ufffd \ufffd\ufffd\u0018\ufffd\/\ufffd6 +\u0004\u0014\u001c@\u01d6\ufffd40\ufffdz\u000ex\u0013\ufffd\u0011]\u061b\ufffd\u03e2\u001c\u021e62\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP[0\ufffdNXg\ufffd\ufffd\ufffd\ufffd*\ufffd k\ne\ufffdQ\ufffd \ufffd\ufffd\ufffd\/\ufffd6 +@\u01d6\ufffd40\ufffdzx\ufffd]\u061b\ufffd\u03e2\u021e62\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003[0\ufffdNXg\ufffd\ufffd\u001f\ufffd\ufffd*\ufffd k\n\u0004e\ufffdQ\ufffd \ufffd\ufffd\u0018\ufffd\/\ufffd6 +\u0004\u0014\u001c@\u01d6\ufffd40\ufffdz\u000ex\u0013\ufffd\u0011]\u061b\ufffd\u03e2\u001c\u021e62\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP[0\ufffdNXg\ufffd\ufffd\ufffd\ufffd*\ufffd k\ne\ufffdQ\ufffd \ufffd\ufffd\ufffd\/\ufffd6 +@\u01d6\ufffd40\ufffdzx\ufffd]\u061b\ufffd\u03e2\u021e62\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��]%�Ȃ�oi�������q�Ժ��Rd� ��� Si̟8A(~B8����q� "��g㨽�����R� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��]%�Ȃ�oi�������q�Ժ��Rd� ��� Si̟8A(~B8����q� "��g㨽�����R� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��]%�Ȃ�oi�������q�Ժ��Rd� ��� Si̟8A(~B8����q� "��g㨽�����R� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.983353151284878,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "2e54449964fdc04d1747993ea44cbb09",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\u0002\ufffd\u053a\ufffd\ufffdRd\ufffd\u0017\u0012\u001e\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\u0000\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\u0002\ufffd\u053a\ufffd\ufffdRd\ufffd\u0017\u0012\u001e\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\u0000\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\u0002\ufffd\u053a\ufffd\ufffdRd\ufffd\u0017\u0012\u001e\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\u0000\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb209dad25a550643b3992ce4ac543927c302661",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\u0002\ufffd\u053a\ufffd\ufffdRd\ufffd\u0017\u0012\u001e\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\u0000\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u053a\ufffd\ufffdRd\ufffd\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\u0002\ufffd\u053a\ufffd\ufffdRd\ufffd\u0017\u0012\u001e\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\u0000\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd]%\ufffd\u0202\ufffdoi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u053a\ufffd\ufffdRd\ufffd\ufffd\ufffd\ufffd Si\u031f8A(~B8\ufffd\ufffd\ufffd\ufffdq\ufffd\"\ufffd\ufffdg\u3a3d\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
Payload
�L��Bہ߿38݉�q@c>O��__(������ "l�4�-����<:�� �ZCoբ -�5+��( >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�L��Bہ߿38݉�q@c>O��__(������ "l�4�-����<:�� �ZCoբ -�5+��( >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�L��Bہ߿38݉�q@c>O��__(������ "l�4�-����<:�� �ZCoբ -�5+��( >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.946584044533563,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9e2d45c0f735691763c6bb9a490112d677b33dc",
"event_fingerprint": "ed4da39dbfd6bd869dcf33c40bc3768fc30a9388",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "acdabd64edbc4a87e70fbefd2256cca2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003L\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd\u0015__\u0001\u001b(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd\b<:\ufffd\ufffd\t\ufffdZC\u0006o\u0562\u000b-\ufffd5+\ufffd\ufffd(\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003L\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd\u0015__\u0001\u001b(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd\b<:\ufffd\ufffd\t\ufffdZC\u0006o\u0562\u000b-\ufffd5+\ufffd\ufffd(\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003L\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd\u0015__\u0001\u001b(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd\b<:\ufffd\ufffd\t\ufffdZC\u0006o\u0562\u000b-\ufffd5+\ufffd\ufffd(\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1daa4dc04e7e2d29f927dc669236c95fd7cfec3b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003L\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd\u0015__\u0001\u001b(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd\b<:\ufffd\ufffd\t\ufffdZC\u0006o\u0562\u000b-\ufffd5+\ufffd\ufffd(\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdL\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd__(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd<:\ufffd\ufffd\t\ufffdZCo\u0562-\ufffd5+\ufffd\ufffd(>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003L\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd\u0015__\u0001\u001b(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd\b<:\ufffd\ufffd\t\ufffdZC\u0006o\u0562\u000b-\ufffd5+\ufffd\ufffd(\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdL\ufffd\ufffdB\u06c1\u07ff38\u0749\ufffdq@c>O\ufffd\ufffd__(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \"l\ufffd4\ufffd-\ufffd\ufffd\ufffd\ufffd<:\ufffd\ufffd\t\ufffdZCo\u0562-\ufffd5+\ufffd\ufffd(>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��)#�������:�=�`����Z�xǞl�� ����6���^��}��#W�� j��p^Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��)#�������:�=�`����Z�xǞl�� ����6���^��}��#W��
j��p^Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��)#�������:�=�`����Z�xǞl�� ����6���^��}��#W�� j��p^Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.0407879483209985,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "a83cc5cda8b273bd6555b4131ceb1ac8355079b8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "305ab378fb8242dbaefabfabd0e61e9c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)#\ufffd\ufffd\u0005\ufffd\u0013\ufffd\ufffd\ufffd\u0013\ufffd:\u001b\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\u0002\ufffd\ufffd \u001f\ufffd\ufffd\ufffd\ufffd\u00196\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffd\u0018p^Y\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)#\ufffd\ufffd\u0005\ufffd\u0013\ufffd\ufffd\ufffd\u0013\ufffd:\u001b\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\u0002\ufffd\ufffd \u001f\ufffd\ufffd\ufffd\ufffd\u00196\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffd\u0018p^Y\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)#\ufffd\ufffd\u0005\ufffd\u0013\ufffd\ufffd\ufffd\u0013\ufffd:\u001b\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\u0002\ufffd\ufffd \u001f\ufffd\ufffd\ufffd\ufffd\u00196\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffd\u0018p^Y\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e387931d8edecceee567ffb3134931fe1e2e93ba",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)#\ufffd\ufffd\u0005\ufffd\u0013\ufffd\ufffd\ufffd\u0013\ufffd:\u001b\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\u0002\ufffd\ufffd \u001f\ufffd\ufffd\ufffd\ufffd\u00196\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffd\u0018p^Y\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd)#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffdp^Y\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)#\ufffd\ufffd\u0005\ufffd\u0013\ufffd\ufffd\ufffd\u0013\ufffd:\u001b\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\u0002\ufffd\ufffd \u001f\ufffd\ufffd\ufffd\ufffd\u00196\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffd\u0018p^Y\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd)#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd=\ufffd`\ufffd\ufffd\ufffd\ufffdZ\ufffdx\u01del\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd^\ufffd\ufffd}\ufffd\ufffd#W\ufffd\ufffd\nj\ufffd\ufffdp^Y\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 62e06658a71a2a67 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��ʏ�_�p<�t�i�o}��u峈yx�ͱ.# n��L���; %� \��<�h}����ar�ѥi�� �ZZ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ʏ�_�p<�t�i�o}��u峈yx�ͱ.# n��L���; %� \��<�h}����ar�ѥi�� �ZZ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��ʏ�_�p<�t�i�o}��u峈yx�ͱ.# n��L���; %� \��<�h}����ar�ѥi�� �ZZ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �:: 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "62e06658a71a2a67717d9b56ff83e695",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.034593955505978,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "a3ad656dd4ce63e2c2318e1dfdf8ae2d6c83ee59",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "62e06658a71a2a67717d9b56ff83e695",
"payload_hash": "e7db6ed29f3268dc172c9743f5ebd90d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffd\u0011i\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;\u001f%\ufffd\u001c\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\u0019\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffd\u0011i\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;\u001f%\ufffd\u001c\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\u0019\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd::\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffd\u0011i\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;\u001f%\ufffd\u001c\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\u0019\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c788b1f85c7084598edb1581ebda8ab58126a39e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffd\u0011i\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;\u001f%\ufffd\u001c\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\u0019\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "62e06658a71a2a67717d9b56ff83e695",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffdi\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;%\ufffd\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\ufffd\ufffd\ufffdZZ\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffd\u0011i\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;\u001f%\ufffd\u001c\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\u0019\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "62e06658a71a2a67717d9b56ff83e695",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u028f\ufffd_\ufffdp<\ufffdt\ufffdi\ufffdo}\ufffd\ufffdu\u5cc8y\u0383x\ufffd\u0371.# n\ufffd\ufffdL\ufffd\ufffd\ufffd;%\ufffd\\\ufffd\ufffd<\ufffdh}\ufffd\ufffd\ufffd\ufffdar\ufffd\u0465i\ufffd\ufffd\ufffdZZ\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���k® �a� ��N� ��:���2�В�� 4Ю֖É͒��u�hOK�P���2���|��� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���k® �a� ��N� ��:���2�В�� 4Ю֖É͒��u�hOK�P���2���|��� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ���k® �a� ��N� ��:���2�В�� 4Ю֖É͒��u�hOK�P���2���|��� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.952217881126776,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "b43d8d72e199df2dafd85bf99a2d6992",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdk\u00ae\t\ufffd\u0012a\ufffd\u0000\ufffd\ufffd\u0017N\ufffd\u001c\ufffd\ufffd\u0012:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\u0010\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0010|\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdk\u00ae\t\ufffd\u0012a\ufffd\u0000\ufffd\ufffd\u0017N\ufffd\u001c\ufffd\ufffd\u0012:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\u0010\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0010|\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdk\u00ae\t\ufffd\u0012a\ufffd\u0000\ufffd\ufffd\u0017N\ufffd\u001c\ufffd\ufffd\u0012:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\u0010\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0010|\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e43756d7753790902484e4106bcf4fd010c5d430",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdk\u00ae\t\ufffd\u0012a\ufffd\u0000\ufffd\ufffd\u0017N\ufffd\u001c\ufffd\ufffd\u0012:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\u0010\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0010|\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdk\u00ae\t\ufffda\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdk\u00ae\t\ufffd\u0012a\ufffd\u0000\ufffd\ufffd\u0017N\ufffd\u001c\ufffd\ufffd\u0012:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\u0010\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0010|\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdk\u00ae\t\ufffda\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd2\ufffd\u0412\ufffd\ufffd 4\u042e\u0596\u00c9\u0352\ufffd\ufffdu\ufffdhOK\ufffdP\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �M�������m�$����-��R �\E��� � _@��G*W/R�� �>����{���] \P � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �M�������m�$����-��R �\E��� � _@��G*W/R�� �>����{���] \P � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �M�������m�$����-��R �\E��� � _@��G*W/R�� �>����{��Κ�] \P � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.04063942796801,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "9dd185c8ac230c08ae622a4d82b0c8f78cdd3665",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "1774eb1fbbc97b9b6ab2149847308fcb",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u0004m\ufffd$\ufffd\ufffd\u0010\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\u0000\ufffd _@\ufffd\ufffd\u0010G*W\/R\ufffd\ufffd\u001d\u001b\ufffd>\ufffd\u0003\ufffd\u0014\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\u001d\\P\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u0004m\ufffd$\ufffd\ufffd\u0010\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\u0000\ufffd _@\ufffd\ufffd\u0010G*W\/R\ufffd\ufffd\u001d\u001b\ufffd>\ufffd\u0003\ufffd\u0014\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\u001d\\P\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u0004m\ufffd$\ufffd\ufffd\u0010\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\u0000\ufffd _@\ufffd\ufffd\u0010G*W\/R\ufffd\ufffd\u001d\u001b\ufffd>\ufffd\u0003\ufffd\u0014\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\u001d\\P\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "297c4f2ae12abb0bb00761d7c861d14d26de0885",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u0004m\ufffd$\ufffd\ufffd\u0010\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\u0000\ufffd _@\ufffd\ufffd\u0010G*W\/R\ufffd\ufffd\u001d\u001b\ufffd>\ufffd\u0003\ufffd\u0014\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\u001d\\P\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd$\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\ufffd _@\ufffd\ufffdG*W\/R\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\\P\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u0004m\ufffd$\ufffd\ufffd\u0010\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\u0000\ufffd _@\ufffd\ufffd\u0010G*W\/R\ufffd\ufffd\u001d\u001b\ufffd>\ufffd\u0003\ufffd\u0014\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\u001d\\P\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd$\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdR \ufffd\\E\ufffd\ufffd\ufffd\ufffd _@\ufffd\ufffdG*W\/R\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\u039a\ufffd]\\P\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��Ï ��� i� y1z#�b(q0�Z��>�H_�T� U�~�MM�kF]���4����U[�P�E�:�* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Ï
��� i� y1z#�b(q0�Z��>�H_�T� U�~�MM�kF]���4����U[�P�E�:�* � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��Ï ��� i� y1z#�b(q0�Z��>�H_�T� U�~�MM�kF]���4����U[�P�E�:�* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.95904780876104,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "ffb2b545d3c4bb4dc81b21f6c2a8dab0",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00cf\r\ufffd\ufffd\ufffd\u001di\ufffd\u0000y1z#\ufffdb(q0\ufffdZ\ufffd\ufffd\u0002>\ufffdH_\ufffdT\ufffd U\ufffd~\u0014\ufffdMM\ufffd\u0013k\u0003F]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd\u0014*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00cf\r\ufffd\ufffd\ufffd\u001di\ufffd\u0000y1z#\ufffdb(q0\ufffdZ\ufffd\ufffd\u0002>\ufffdH_\ufffdT\ufffd U\ufffd~\u0014\ufffdMM\ufffd\u0013k\u0003F]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd\u0014*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00cf\r\ufffd\ufffd\ufffd\u001di\ufffd\u0000y1z#\ufffdb(q0\ufffdZ\ufffd\ufffd\u0002>\ufffdH_\ufffdT\ufffd U\ufffd~\u0014\ufffdMM\ufffd\u0013k\u0003F]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd\u0014*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "238cb57a38776678f0a8d9696ab9618536597eb5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00cf\r\ufffd\ufffd\ufffd\u001di\ufffd\u0000y1z#\ufffdb(q0\ufffdZ\ufffd\ufffd\u0002>\ufffdH_\ufffdT\ufffd U\ufffd~\u0014\ufffdMM\ufffd\u0013k\u0003F]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd\u0014*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u00cf\r\ufffd\ufffd\ufffdi\ufffdy1z#\ufffdb(q0\ufffdZ\ufffd\ufffd>\ufffdH_\ufffdT\ufffd U\ufffd~\ufffdMM\ufffdkF]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00cf\r\ufffd\ufffd\ufffd\u001di\ufffd\u0000y1z#\ufffdb(q0\ufffdZ\ufffd\ufffd\u0002>\ufffdH_\ufffdT\ufffd U\ufffd~\u0014\ufffdMM\ufffd\u0013k\u0003F]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd\u0014*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u00cf\r\ufffd\ufffd\ufffdi\ufffdy1z#\ufffdb(q0\ufffdZ\ufffd\ufffd>\ufffdH_\ufffdT\ufffd U\ufffd~\ufffdMM\ufffdkF]\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdU[\ufffdP\ufffdE\ufffd:\ufffd*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F BD�K���A�k� $�n'�R (��1Q��� :ӟ� �'��tU�&~s�f�+w?P�`k#[� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F BD�K���A�k� $�n'�R (��1Q��� :ӟ� �'��tU�&~s�f�+w?P�`k#[� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F BD�K���A�k� $�n'�R (��1Q��� :ӟ� �'��tU�&~s�f�+w?P�`k#[� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.983098959859958,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "e846cd4be19d096aff9d22143f1bc17ff8503411",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "239e9452fa4a85634bb12219106b5acb",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003D\ufffd\u0012K\ufffd\ufffd\u0015\ufffdA\ufffdk\ufffd\u0000$\ufffdn'\ufffdR\u001c(\u0019\ufffd\ufffd1Q\u0019\ufffd\ufffd\ufffd\u0018 :\u000f\u04df\ufffd\u0000\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+\u000ew?P\ufffd`k#[\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003D\ufffd\u0012K\ufffd\ufffd\u0015\ufffdA\ufffdk\ufffd\u0000$\ufffdn'\ufffdR\u001c(\u0019\ufffd\ufffd1Q\u0019\ufffd\ufffd\ufffd\u0018 :\u000f\u04df\ufffd\u0000\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+\u000ew?P\ufffd`k#[\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003D\ufffd\u0012K\ufffd\ufffd\u0015\ufffdA\ufffdk\ufffd\u0000$\ufffdn'\ufffdR\u001c(\u0019\ufffd\ufffd1Q\u0019\ufffd\ufffd\ufffd\u0018 :\u000f\u04df\ufffd\u0000\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+\u000ew?P\ufffd`k#[\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b392b5d5413322c79c0bef21812feba606c310a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003D\ufffd\u0012K\ufffd\ufffd\u0015\ufffdA\ufffdk\ufffd\u0000$\ufffdn'\ufffdR\u001c(\u0019\ufffd\ufffd1Q\u0019\ufffd\ufffd\ufffd\u0018 :\u000f\u04df\ufffd\u0000\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+\u000ew?P\ufffd`k#[\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FBD\ufffdK\ufffd\ufffd\ufffdA\ufffdk\ufffd$\ufffdn'\ufffdR(\ufffd\ufffd1Q\ufffd\ufffd\ufffd :\u04df\ufffd\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+w?P\ufffd`k#[\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003D\ufffd\u0012K\ufffd\ufffd\u0015\ufffdA\ufffdk\ufffd\u0000$\ufffdn'\ufffdR\u001c(\u0019\ufffd\ufffd1Q\u0019\ufffd\ufffd\ufffd\u0018 :\u000f\u04df\ufffd\u0000\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+\u000ew?P\ufffd`k#[\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FBD\ufffdK\ufffd\ufffd\ufffdA\ufffdk\ufffd$\ufffdn'\ufffdR(\ufffd\ufffd1Q\ufffd\ufffd\ufffd :\u04df\ufffd\ufffd'\u0080\ufffd\ufffdtU\ufffd&~s\ufffdf\ufffd+w?P\ufffd`k#[\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 88f6855c25c4272c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �7;g� TQB�t��zA�gK��ԟ�CM49E �� n �F� �bpG�ȱ�w��d@q����Qv �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �7;g� TQB�t��zA�gK��ԟ�CM49E �� n �F� �bpG�ȱ�w��d@q����Qv �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �7;g� TQB�t��zA�gK��ԟ�CM49E �� n �F� �bpG�ȱ�w��d@q����Qv �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "88f6855c25c4272cc5b48cde069dacc8",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.998443257454704,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "796d5c2e77bbfc31861cf6c8d0e3d365997a8251",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "88f6855c25c4272cc5b48cde069dacc8",
"payload_hash": "dcc9fec8f608eae02ba6d474033a642e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u0012;g\ufffd\u001eTQB\u0002\ufffd\u0004\u000f\u0011t\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffd\u001fn\u0002\f\ufffdF\ufffd\f\ufffdb\u0016p\u0010G\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u0012;g\ufffd\u001eTQB\u0002\ufffd\u0004\u000f\u0011t\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffd\u001fn\u0002\f\ufffdF\ufffd\f\ufffdb\u0016p\u0010G\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u0012;g\ufffd\u001eTQB\u0002\ufffd\u0004\u000f\u0011t\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffd\u001fn\u0002\f\ufffdF\ufffd\f\ufffdb\u0016p\u0010G\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fe3190d1a51f389acf38ebe0bc4905c64673af6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u0012;g\ufffd\u001eTQB\u0002\ufffd\u0004\u000f\u0011t\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffd\u001fn\u0002\f\ufffdF\ufffd\f\ufffdb\u0016p\u0010G\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "88f6855c25c4272cc5b48cde069dacc8",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd7;g\ufffdTQB\ufffdt\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffdn\ufffdF\ufffd\ufffdbpG\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u0012;g\ufffd\u001eTQB\u0002\ufffd\u0004\u000f\u0011t\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffd\u001fn\u0002\f\ufffdF\ufffd\f\ufffdb\u0016p\u0010G\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "88f6855c25c4272cc5b48cde069dacc8",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd7;g\ufffdTQB\ufffdt\ufffd\ufffdzA\ufffdgK\ufffd\ufffd\u051f\ufffdCM49E \ufffd\ufffdn\ufffdF\ufffd\ufffdbpG\ufffd\u0231\ufffdw\ufffd\ufffdd@q\ufffd\ufffd\ufffd\ufffdQv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P����}��)�S2LC�'J O���N�l[�8� ucB�K�ŭ {+�A�(DOt�FSp8%���L F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P����}��)�S2LC�'J O���N�l[�8� ucB�K�ŭ {+�A�(DOt�FSp8%���L F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P����}��)�S2LC�'J O���N�l[�8� ucB�K�ŭ {+�A�(DOt�FSp8%���L F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.083425205018024,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "6dd661685edeca9b437b4575e3bc0c9c11076466",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "3261d4e3084d18f57c16e5c049f2d0bf",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffd\ufffd}\ufffd\u0015\ufffd\b)\ufffdS2L\u0004C\ufffd'J\u001fO\ufffd\ufffd\ufffdN\ufffdl[\u000e\ufffd8\ufffd ucB\ufffdK\ufffd\u016d\u001d{+\ufffdA\ufffd(DO\u0011t\ufffdFS\bp8%\ufffd\ufffd\ufffdL\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffd\ufffd}\ufffd\u0015\ufffd\b)\ufffdS2L\u0004C\ufffd'J\u001fO\ufffd\ufffd\ufffdN\ufffdl[\u000e\ufffd8\ufffd ucB\ufffdK\ufffd\u016d\u001d{+\ufffdA\ufffd(DO\u0011t\ufffdFS\bp8%\ufffd\ufffd\ufffdL\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffd\ufffd}\ufffd\u0015\ufffd\b)\ufffdS2L\u0004C\ufffd'J\u001fO\ufffd\ufffd\ufffdN\ufffdl[\u000e\ufffd8\ufffd ucB\ufffdK\ufffd\u016d\u001d{+\ufffdA\ufffd(DO\u0011t\ufffdFS\bp8%\ufffd\ufffd\ufffdL\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2c670304cfbf3d988c33e2cb7358ba907e28385",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffd\ufffd}\ufffd\u0015\ufffd\b)\ufffdS2L\u0004C\ufffd'J\u001fO\ufffd\ufffd\ufffdN\ufffdl[\u000e\ufffd8\ufffd ucB\ufffdK\ufffd\u016d\u001d{+\ufffdA\ufffd(DO\u0011t\ufffdFS\bp8%\ufffd\ufffd\ufffdL\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\ufffd\ufffd\ufffd\ufffd}\ufffd\ufffd)\ufffdS2LC\ufffd'JO\ufffd\ufffd\ufffdN\ufffdl[\ufffd8\ufffd ucB\ufffdK\ufffd\u016d{+\ufffdA\ufffd(DOt\ufffdFSp8%\ufffd\ufffd\ufffdLF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffd\ufffd}\ufffd\u0015\ufffd\b)\ufffdS2L\u0004C\ufffd'J\u001fO\ufffd\ufffd\ufffdN\ufffdl[\u000e\ufffd8\ufffd ucB\ufffdK\ufffd\u016d\u001d{+\ufffdA\ufffd(DO\u0011t\ufffdFS\bp8%\ufffd\ufffd\ufffdL\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd\ufffd\ufffd\ufffd}\ufffd\ufffd)\ufffdS2LC\ufffd'JO\ufffd\ufffd\ufffdN\ufffdl[\ufffd8\ufffd ucB\ufffdK\ufffd\u016d{+\ufffdA\ufffd(DOt\ufffdFSp8%\ufffd\ufffd\ufffdLF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��ãDWG�MA�T�о�c�@1F�Y�,����� ��q��?� W$s�Wa��q�Z:M��* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ãDWG�MA�T�о�c�@1F�Y�,����� ��q��?� W$s�Wa��q�Z:M��* � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��ãDWG�MA�T�о�c�@1F�Y�,����� ��q��?� W$s�Wa��q�Z:M��* � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.992397264465151,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "78e0746d15fa29a9b8d1118af0f19bb19a21bae2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "e08dc4fa9071399343cab80c0bfb4f8d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\u001a\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\u001b\u0016\ufffd\ufffd \ufffd\ufffdq\ufffd\u0019\ufffd?\ufffd\u001d\u0012\u001bW$s\u0017\ufffdWa\u0006\u0015\u0005\ufffd\ufffdq\ufffdZ\u0017:M\ufffd\ufffd*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\u001a\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\u001b\u0016\ufffd\ufffd \ufffd\ufffdq\ufffd\u0019\ufffd?\ufffd\u001d\u0012\u001bW$s\u0017\ufffdWa\u0006\u0015\u0005\ufffd\ufffdq\ufffdZ\u0017:M\ufffd\ufffd*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\u001a\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\u001b\u0016\ufffd\ufffd \ufffd\ufffdq\ufffd\u0019\ufffd?\ufffd\u001d\u0012\u001bW$s\u0017\ufffdWa\u0006\u0015\u0005\ufffd\ufffdq\ufffdZ\u0017:M\ufffd\ufffd*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "622d57a86047a598dc80942b1139dc6819d16035",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\u001a\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\u001b\u0016\ufffd\ufffd \ufffd\ufffdq\ufffd\u0019\ufffd?\ufffd\u001d\u0012\u001bW$s\u0017\ufffdWa\u0006\u0015\u0005\ufffd\ufffdq\ufffdZ\u0017:M\ufffd\ufffd*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdq\ufffd\ufffd?\ufffdW$s\ufffdWa\ufffd\ufffdq\ufffdZ:M\ufffd\ufffd*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\u001a\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\u001b\u0016\ufffd\ufffd \ufffd\ufffdq\ufffd\u0019\ufffd?\ufffd\u001d\u0012\u001bW$s\u0017\ufffdWa\u0006\u0015\u0005\ufffd\ufffdq\ufffdZ\u0017:M\ufffd\ufffd*\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u00e3DWG\ufffdMA\ufffdT\ufffd\u043e\ufffdc\ufffd@1F\ufffdY\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdq\ufffd\ufffd?\ufffdW$s\ufffdWa\ufffd\ufffdq\ufffdZ:M\ufffd\ufffd*\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���m�XK,� �>��C N ��"� ��˭[(�� ��3u���H�i�@��$�v�� =ڷ��[�t.� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���m�XK,�
�>��C
N ��"� ��˭[(�� ��3u���H�i�@��$�v��
=ڷ��[�t.� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ���m�XK,� �>��C N ��"� ��˭[(�� ��3u���H�i�@��$�v�� =ڷ��[�t.� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.991753941210882,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "910fc5e7137ce2218ce38d484f85ac66ec73f091",
"event_fingerprint": "f224b5e9b0aaf679e069cc3d04901b17bfd13cde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "5eec15938c8b87d86f38b0f869d99939",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\u001d\ufffd\ufffd\"\ufffd\u001c\ufffd\ufffd\u02ed[\u0015(\ufffd\ufffd \ufffd\ufffd3u\u0013\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\u0017\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\u001d\ufffd\ufffd\"\ufffd\u001c\ufffd\ufffd\u02ed[\u0015(\ufffd\ufffd \ufffd\ufffd3u\u0013\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\u0017\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\u001d\ufffd\ufffd\"\ufffd\u001c\ufffd\ufffd\u02ed[\u0015(\ufffd\ufffd \ufffd\ufffd3u\u0013\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\u0017\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e905031536539694d8175fb50fdcdf8b958cc27",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\u001d\ufffd\ufffd\"\ufffd\u001c\ufffd\ufffd\u02ed[\u0015(\ufffd\ufffd \ufffd\ufffd3u\u0013\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\u0017\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\ufffd\ufffd\"\ufffd\ufffd\ufffd\u02ed[(\ufffd\ufffd \ufffd\ufffd3u\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\u001d\ufffd\ufffd\"\ufffd\u001c\ufffd\ufffd\u02ed[\u0015(\ufffd\ufffd \ufffd\ufffd3u\u0013\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\u0017\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdm\ufffdXK,\ufffd\n\ufffd>\ufffd\ufffdC\nN\ufffd\ufffd\"\ufffd\ufffd\ufffd\u02ed[(\ufffd\ufffd \ufffd\ufffd3u\ufffd\ufffd\ufffdH\ufffdi\ufffd@\ufffd\ufffd$\ufffdv\ufffd\ufffd\r=\u06b7\ufffd\ufffd[\ufffdt.\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6606 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6606 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6606
Chemin / cible
—
Service
TLS
Payload
��"6�51G��@*�;�� �}*��-[ _ )��`�Y(>3��D��]�L������1 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��"6�51G��@*�;�� �}*��-[ _ )��`�Y(>3��D��]�L������1 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��"6�51G��@*�;�� �}*��-[ _ )��`�Y(>3��D��]�L������1 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9421619548424225,
"port_category": "registered",
"org": "Interconnecx, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 13737,
"country": "US",
"dst_port": 6606,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9e2d45c0f735691763c6bb9a490112d677b33dc",
"event_fingerprint": "ed4da39dbfd6bd869dcf33c40bc3768fc30a9388",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 13737,
"org": "Interconnecx, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "8037ca8ac9c26e1037ebdec92922172a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6606,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0006\"\u000e6\ufffd\u0002\u001451\u0011G\ufffd\u0019\u0012\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[\u0001 _\u0010\u001d)\ufffd\ufffd`\ufffdY(>3\ufffd\u0017\u0002\ufffdD\ufffd\ufffd]\ufffdL\u0006\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd1\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0006\"\u000e6\ufffd\u0002\u001451\u0011G\ufffd\u0019\u0012\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[\u0001 _\u0010\u001d)\ufffd\ufffd`\ufffdY(>3\ufffd\u0017\u0002\ufffdD\ufffd\ufffd]\ufffdL\u0006\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd1\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0006\"\u000e6\ufffd\u0002\u001451\u0011G\ufffd\u0019\u0012\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[\u0001 _\u0010\u001d)\ufffd\ufffd`\ufffdY(>3\ufffd\u0017\u0002\ufffdD\ufffd\ufffd]\ufffdL\u0006\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd1\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92628b8772d9ac729a13cac6882f78277af38bfa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0006\"\u000e6\ufffd\u0002\u001451\u0011G\ufffd\u0019\u0012\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[\u0001 _\u0010\u001d)\ufffd\ufffd`\ufffdY(>3\ufffd\u0017\u0002\ufffdD\ufffd\ufffd]\ufffdL\u0006\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd1\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\"6\ufffd51G\ufffd\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[ _)\ufffd\ufffd`\ufffdY(>3\ufffd\ufffdD\ufffd\ufffd]\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6606,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0006\"\u000e6\ufffd\u0002\u001451\u0011G\ufffd\u0019\u0012\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[\u0001 _\u0010\u001d)\ufffd\ufffd`\ufffdY(>3\ufffd\u0017\u0002\ufffdD\ufffd\ufffd]\ufffdL\u0006\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd1\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 6606,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6606 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\"6\ufffd51G\ufffd\ufffd@*\ufffd;\ufffd\ufffd\t\ufffd}*\ufffd\ufffd-[ _)\ufffd\ufffd`\ufffdY(>3\ufffd\ufffdD\ufffd\ufffd]\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6606 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6606"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|