Renseignement sur les menaces

États-Unis

77.91.118.50

FAI Contrust Solutions S.R.L. Première vue 13/05/2026 09:18 UTC Dernière vue 19/06/2026 14:50 UTC Risque Critique

Période analysée : 2026-05-20 → 2026-06-19

Activité suspecte — risque 45/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 13/05/2026 09:18 UTC

Dernière observation 19/06/2026 14:50 UTC

Événements (période) 755

MITRE ATT&CK principal TA0007 132 occurrences

Activité suspecte — risque 45/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « xss_attack » (signaux protocolaires) · confiance 59%

Confiance 67 % — Score WAF 72 · Bonus corrélation +8 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 209896 · 77.91.118.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 755 événements sur la période pour cette IP.

77.91.118.18 Sonde TLS 19/06/2026 15:23 UTC
93.152.221.6 Sonde TLS 16/05/2026 10:02 UTC
77.91.118.38 web attack 13/05/2026 11:09 UTC
77.91.118.42 web attack 13/05/2026 09:41 UTC
77.91.118.46 web attack 13/05/2026 09:17 UTC
206.123.144.19 web attack 12/05/2026 19:15 UTC
206.123.144.21 web attack 12/05/2026 18:02 UTC
206.123.144.18 web attack 12/05/2026 17:42 UTC

Événements (filtres)

755

Première observation

13/05/2026 09:18 UTC

Dernière observation

19/06/2026 14:50 UTC

Dernière activité (filtres)

19/06/2026 14:50 UTC

Événements 7j

204

Ports distincts (7j)

101

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 366 TLS TCP 358 QUIC HTTP3 STUB TCP 4 FIREBIRD TCP 4 SAP MS TCP 2 NETBUS TCP 2 KAFKA CONTROLLER TCP 2 KAFKA JMX TCP 2 ADMIN ALT TCP 2 CLICKHOUSE NATIVE TCP 2 REGISTRY PROBE TCP 2 MSSQL TCP 2 SAP Diag TCP 2 NAMESERVER TCP 2 SPLUNK TCP 1 PHAROS TCP 1 MINIKUBE NODEPORT TCP 1

HTTP

366

TLS

358

QUIC HTTP3 STUB

FIREBIRD

SAP MS

NETBUS

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Contrust Solutions S.R.L. 724 Port 7332 tls_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

xss attack · via HTTP:7332 · (tentative d'exploit)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S…

Aperçu payload

GET / HTTP/1.1 Host: 62.3.50.33:7332 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec

Port / service

7332 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0284

Confiance

67% Corrélation +8

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

755 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

755 événement(s) — page 5/16

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/06/2026 14:19:48 UTC	TCP	12220 · TLS	tls	Sonde TLS tls probe · via TLS:12220 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12220 Chemin / cible — Service TLS Payload �[ 0�/]�~��:��"��ߣ� Ṑ� :��I����䒭�y�m6t��Ub�B�Ճ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �[0�/]�~��:��"��ߣ� Ṑ� :��I����䒭�y�m6t��Ub�B�Ճ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �[ 0�/]�~��:��"��ߣ� Ṑ� :��I����䒭�y�m6t��Ub�B�Ճ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.273026247637348, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 12220, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c38ec186d73086012acce7e51b11763d8b9f7884", "event_fingerprint": "de7b0f4c662cac3bc3242633bb4ced616e2509cb", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "a018022baa31d4c712627c79cf7f97e9", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 12220, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\u000b0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u001c\u07e3\ufffd\r\u0007\u1e50\ufffd :\ufffd\ufffd\u0000I\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\u0015\ufffd\u0002\u0543\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\u000b0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u001c\u07e3\ufffd\r\u0007\u1e50\ufffd :\ufffd\ufffd\u0000I\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\u0015\ufffd\u0002\u0543\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\u000b0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u001c\u07e3\ufffd\r\u0007\u1e50\ufffd :\ufffd\ufffd\u0000I\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\u0015\ufffd\u0002\u0543\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d6737537f9c84543b9e98886ed07e642840d5b4", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\u000b0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u001c\u07e3\ufffd\r\u0007\u1e50\ufffd :\ufffd\ufffd\u0000I\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\u0015\ufffd\u0002\u0543\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 12220, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd[0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u07e3\ufffd\r\u1e50\ufffd :\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\ufffd\u0543\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:12220 \u00b7 (sonde \/ probe)", "target_port_label": "12220 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12220, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\u000b0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u001c\u07e3\ufffd\r\u0007\u1e50\ufffd :\ufffd\ufffd\u0000I\ufffd\ufffd\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\u0015\ufffd\u0002\u0543\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 12220, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:12220 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd[0\ufffd\/]\ufffd~\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u07e3\ufffd\r\u1e50\ufffd :\ufffd\ufffdI\ufffd\ufffd*\ufffd\ufffd\u44ad\ufffdy\ufffdm6t\ufffd\ufffd\ufffdUb\ufffdB\ufffd\u0543\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "12220 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12220" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/06/2026 14:19:48 UTC	TCP	12220 · HTTP	http	Cross-site scripting xss attack · via HTTP:12220 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12220 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12220 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12220 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "fb056462e1484fd09c0f2f2d5245ab8b30390ef6", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.454786393580445, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 12220, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c946b4137c8094d9a92818d611cf155280410324", "event_fingerprint": "74592094e111949a56aacf1544fcfdb6faa53f81", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "328d3e55d866bca0713f6bc60b46cf71", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 12220, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8591f2535eb885df8ef7b2154d88982fc844bde", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 12220, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:12220 \u00b7 (tentative d'exploit)", "target_port_label": "12220 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12220, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 12220, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:12220 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12220\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "12220 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12220" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/06/2026 14:12:59 UTC	TCP	1996 · TLS	tls	Sonde TLS tls probe · via TLS:1996 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1996 Chemin / cible — Service TLS Payload ��G��e�]e�UN��n��ٯQ��B��=�� p((�k�(��8��n��#�_'��T�_\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��G��e�]e�UN��n��ٯQ��B��=�� p((�k�(��8��n��#�_'��T�_\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��G��e�]e�UN��n��ٯQ��B��=�� p((�k�(��8��n��#�_'��T�_\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.267830219493247, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 1996, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "46cc2ab56e07f6f88f2098d0d56ff25ace579656", "event_fingerprint": "f2ec0b7f4256135e3599f79bcaab8ea96466c920", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "32ebe97f58f37d1756b790028af1f2d0", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 1996, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p(\u0013(\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\u0014\ufffd\ufffd\u0006#\ufffd_'\u000e\ufffd\u0002\ufffdT\ufffd_\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p(\u0013(\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\u0014\ufffd\ufffd\u0006#\ufffd_'\u000e\ufffd\u0002\ufffdT\ufffd_\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p(\u0013(\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\u0014\ufffd\ufffd\u0006#\ufffd_'\u000e\ufffd\u0002\ufffdT\ufffd_\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1f391333deab331aa0566db866cbbff1ac4334cd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p(\u0013(\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\u0014\ufffd\ufffd\u0006#\ufffd_'\u000e\ufffd\u0002\ufffdT\ufffd_\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1996, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p((\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd#\ufffd_'\ufffd\ufffdT\ufffd_\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:1996 \u00b7 (sonde \/ probe)", "target_port_label": "1996 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1996, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffdUN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p(\u0013(\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\u0014\ufffd\ufffd\u0006#\ufffd_'\u000e\ufffd\u0002\ufffdT\ufffd_\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1996, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:1996 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd]e\ufffd*UN\ufffd\ufffdn\ufffd\ufffd\u066fQ\ufffd\ufffdB\ufffd\ufffd=\ufffd\ufffd p((\ufffdk\ufffd(\ufffd\ufffd8\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd#\ufffd_'\ufffd\ufffdT\ufffd_\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "1996 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1996" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/06/2026 14:12:59 UTC	TCP	1996 · HTTP	http	Cross-site scripting xss attack · via HTTP:1996 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1996 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1996 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1996 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "dd6110f09fbdcbff3f3b4a01565c2436d2497966", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451167525995719, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 1996, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b66e3762285e9be4bded84557fb1a079a7da850f", "event_fingerprint": "58e0137eb5a712a616f91fcc26463fb95b97bb07", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "2d7fb254dc8c2107cfcdb85a5783c067", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1996, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "44f66dbf766705f06c7e6baffd62d030a6931c48", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1996, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:1996 \u00b7 (tentative d'exploit)", "target_port_label": "1996 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1996, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1996, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:1996 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1996\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "1996 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1996" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
09/06/2026 22:10:46 UTC	TCP	9999 · ADMIN ALT	admin-alt	admin-alt admin-alt · via ADMIN ALT:9999 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur ADMIN-ALT WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9999 Chemin / cible — Service ADMIN ALT Payload �جJ� h��7^ϔԧ��:��;H�~4l A#jW�$ ��w��b�w�i_�Wv��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « admin-alt » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �جJ� h��7^ϔԧ��:��;H�~4l A#jW�$ ��w��b�w�i_�Wv��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �جJ� h��7^ϔԧ��:��;H�~4l A#jW�$ ��w��b�w�i_�Wv��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.275581151736498, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "admin-alt", "app_proto": "admin-alt", "asn": 209896, "country": "US", "dst_port": 9999, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "71e0a038aaec3062d9b3f018bb65ab92d2779b4c", "event_fingerprint": "bdae3a5e708dccdbe307a2861747dd09885f206a", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "admin-alt", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1431e51752f0f1684a1635328c51d560", "path_pattern_hash": "d3aaa0a3d94e4e5a70802f7b7e17f9f7" }, "target_context": { "dst_port": 9999, "service": "admin-alt", "service_name": "admin-alt", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u062c\u0004J\u0004\ufffd\nh\ufffd\ufffd\u001d\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\u0019\ufffd\u0004~4l A#jW\u0013\ufffd$\u0013 \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffd\u001aw\ufffdi_\ufffd\u0010Wv\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u062c\u0004J\u0004\ufffd\nh\ufffd\ufffd\u001d\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\u0019\ufffd\u0004~4l A#jW\u0013\ufffd$\u0013 \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffd\u001aw\ufffdi_\ufffd\u0010Wv\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u062c\u0004J\u0004\ufffd\nh\ufffd\ufffd\u001d\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\u0019\ufffd\u0004~4l A#jW\u0013\ufffd$\u0013 \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffd\u001aw\ufffdi_\ufffd\u0010Wv\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a0ad3ac1a2a542c9b09fa41cd9cccf41a71fde21", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u062c\u0004J\u0004\ufffd\nh\ufffd\ufffd\u001d\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\u0019\ufffd\u0004~4l A#jW\u0013\ufffd$\u0013 \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffd\u001aw\ufffdi_\ufffd\u0010Wv\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9999, "service": "admin-alt", "service_label_fr": "ADMIN ALT" }, "evidence_snippet": "\ufffd\u062cJ\ufffd\nh\ufffd\ufffd\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\ufffd~4l A#jW\ufffd$ \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffdw\ufffdi_\ufffdWv\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)", "target_port_label": "9999 \u00b7 ADMIN ALT", "emulator_service": "admin-alt", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "admin-alt", "service_label_fr": "ADMIN ALT", "dst_port": 9999, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-admin-alt", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u062c\u0004J\u0004\ufffd\nh\ufffd\ufffd\u001d\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\u0019\ufffd\u0004~4l A#jW\u0013\ufffd$\u0013 \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffd\u001aw\ufffdi_\ufffd\u0010Wv\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9999, "service": "admin-alt", "service_label_fr": "ADMIN ALT" }, "attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u062cJ\ufffd\nh\ufffd\ufffd\ufffd\ufffd7^\u03d4\u0527\ufffd\ufffd:\ufffd\ufffd;H\ufffd~4l A#jW\ufffd$ \ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdb\ufffdw\ufffdi_\ufffdWv\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9999 \u00b7 ADMIN ALT", "emulator_service": "admin-alt", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "admin_alt", "service_banner": "honeypot-admin-alt", "service_os": "linux", "dst_port": "9999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
09/06/2026 22:10:46 UTC	TCP	9999 · HTTP	http	Cross-site scripting xss attack · via HTTP:9999 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9999 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9999 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9999 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "83a22baaf629d53e39c79d30e6b18dca9da1a92c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451167525995719, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 9999, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "aa0d080d5f055349ccfe5818e9c44f4a4640be4f", "event_fingerprint": "40878c406b78c3c05ae157428aaa7e6fc39c6cac", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "71db7fbbfa040c06f3b0abcedecc8979", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9999, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a950e6acff8f7a5302b9936d9dbcdeed9e7a33b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9999, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "admin-alt", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
08/06/2026 19:37:40 UTC	TCP	22222 · HTTP	http	Cross-site scripting xss attack · via HTTP:22222 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 22222 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:22222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:22222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "8ccdbc069a681fa930ac8d7f48511c3a9fab10c0", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.45775147307367, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 22222, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "af622e360391321e493c8b65667daab14ec490b7", "event_fingerprint": "a1d52f3174b9d040f6173e0b9873bf372b78cb4a", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "2fb5020388d86e3beadc81a2a2939088", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 22222, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7d357fd62d7b0a3008d89db994f82646e82595a0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 22222, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:22222 \u00b7 (tentative d'exploit)", "target_port_label": "22222 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 22222, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 22222, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:22222 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "22222 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "22222" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 19:37:35 UTC	TCP	22222 · TLS	tls	Sonde TLS tls probe · via TLS:22222 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22222 Chemin / cible — Service TLS Payload ��{�0̃��n�s[��W lrH�a��oqA� �z��iQ��d�pN;��M�?fJ� zg\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��{�0̃��n�s[��W lrH�a��oqA� �z��iQ��d�pN;��M�?fJ� zg\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��{�0̃��n�s[��W lrH�a��oqA� �z��iQ��d�pN;��M�?fJ� zg\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.322068794844451, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 22222, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ccd397c4776fe9f9f1cf1e7614cf0ff25d9049ea", "event_fingerprint": "779329a49de883f2ac55541bc8cd28259724db7e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "6aafa3354ae33b9c1821c63921ba84ed", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 22222, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd{\ufffd0\u0001\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\u0011\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffd\u0006pN;\ufffd\ufffdM\ufffd?\u0015fJ\ufffd zg\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd{\ufffd0\u0001\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\u0011\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffd\u0006pN;\ufffd\ufffdM\ufffd?\u0015fJ\ufffd zg\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd{\ufffd0\u0001\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\u0011\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffd\u0006pN;\ufffd\ufffdM\ufffd?\u0015fJ\ufffd zg\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4984cabcd7d308507e15bf9729fc1cb7fd47f8b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd{\ufffd0\u0001\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\u0011\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffd\u0006pN;\ufffd\ufffdM\ufffd?\u0015fJ\ufffd zg\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 22222, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd{\ufffd0\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffdpN;\ufffd\ufffdM\ufffd?fJ\ufffd zg\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:22222 \u00b7 (sonde \/ probe)", "target_port_label": "22222 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 22222, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd{\ufffd0\u0001\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffdz\ufffd\u0011\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffd\u0006pN;\ufffd\ufffdM\ufffd?\u0015fJ\ufffd zg\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 22222, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:22222 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd{\ufffd0\u0303\ufffd\ufffdn\ufffds[\ufffd\ufffd\ufffd\ufffdW lrH\ufffda\ufffd\ufffdoqA\ufffd \ufffd*z\ufffd\ufffd\ufffdiQ\ufffd\ufffd\ufffdd\ufffdpN;\ufffd\ufffdM\ufffd?fJ\ufffd zg\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "22222 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "22222" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
08/06/2026 16:59:07 UTC	TCP	30000 · MINIKUBE NODEPORT	minikube-nodeport	Sonde Kubernetes API kubernetes probe · via MINIKUBE NODEPORT:30000 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MINIKUBE-NODEPORT WAF — Recommandation Surveiller Tags minikube_nodeport_emulated minikube_nodeport_payload net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30000 Chemin / cible — Service MINIKUBE NODEPORT Payload �6��(j�(-�I��sE�&��U��?&�۔� ��Π��hO��d�.\|��Sbs9.c�]� )\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �6��(j�(-�I��sE�&��U��?&�۔� ��Π��hO��d�.\|��Sbs9.c�]� )\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �6��(j�(-�I��sE�&��U��?&�۔� ��Π��hO��d�.\|��Sbs9.c�]� )\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.266998503319457, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "minikube-nodeport", "app_proto": "minikube-nodeport", "asn": 209896, "country": "US", "dst_port": 30000, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "e25cd50adca5c9c83f3efd81ac5acc9109b222a1", "event_fingerprint": "f1cce9d1ec2c20f03a9869cf6a12cb41de3a3b92", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "minikube-nodeport", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c58eb9e87f327f0e39b12a05c0036a52", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 30000, "service": "minikube-nodeport", "service_name": "minikube-nodeport", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\u0006\ufffdsE\ufffd\u0017\u0000&\ufffd\ufffdU\ufffd\ufffd?\u0012&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\u001c\ufffd\u0001\ufffdd\ufffd.\|\ufffd\ufffdSbs9.\u001bc\ufffd]\ufffd \u0012)\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\u0006\ufffdsE\ufffd\u0017\u0000&\ufffd\ufffdU\ufffd\ufffd?\u0012&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\u001c\ufffd\u0001\ufffdd\ufffd.\|\ufffd\ufffdSbs9.\u001bc\ufffd]\ufffd \u0012)\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\u0006\ufffdsE\ufffd\u0017\u0000&\ufffd\ufffdU\ufffd\ufffd?\u0012&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\u001c\ufffd\u0001\ufffdd\ufffd.\|\ufffd\ufffdSbs9.\u001bc\ufffd]\ufffd \u0012)\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b27ecf3764edcb954abe6c7093236bb47fabcee3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\u0006\ufffdsE\ufffd\u0017\u0000&\ufffd\ufffdU\ufffd\ufffd?\u0012&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\u001c\ufffd\u0001\ufffdd\ufffd.\|\ufffd\ufffdSbs9.\u001bc\ufffd]\ufffd \u0012)\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 30000, "service": "minikube-nodeport", "service_label_fr": "MINIKUBE NODEPORT" }, "evidence_snippet": "\ufffd6\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\ufffdsE\ufffd&\ufffd\ufffdU\ufffd\ufffd?&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\ufffd\ufffdd\ufffd.\|\ufffd\ufffdSbs9.c\ufffd]\ufffd )\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "kubernetes probe \u00b7 via MINIKUBE NODEPORT:30000 \u00b7 (sonde \/ probe)", "target_port_label": "30000 \u00b7 MINIKUBE NODEPORT", "emulator_service": "minikube-nodeport", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "minikube-nodeport", "service_label_fr": "MINIKUBE NODEPORT", "dst_port": 30000, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-minikube-nodeport", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\u0006\ufffdsE\ufffd\u0017\u0000&\ufffd\ufffdU\ufffd\ufffd?\u0012&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\u001c\ufffd\u0001\ufffdd\ufffd.\|\ufffd\ufffdSbs9.\u001bc\ufffd]\ufffd \u0012)\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 30000, "service": "minikube-nodeport", "service_label_fr": "MINIKUBE NODEPORT" }, "attack_vector": "kubernetes probe \u00b7 via MINIKUBE NODEPORT:30000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd6\ufffd\ufffd(j\ufffd(-\ufffdI\ufffd\ufffdsE\ufffd&\ufffd\ufffdU\ufffd\ufffd?&\ufffd\u06d4\ufffd \ufffd\ufffd\u03a0\ufffd\ufffdhO\ufffd\ufffdd\ufffd.\|\ufffd\ufffdSbs9.c\ufffd]\ufffd )\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "30000 \u00b7 MINIKUBE NODEPORT", "emulator_service": "minikube-nodeport", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "minikube_nodeport", "service_banner": "honeypot-minikube-nodeport", "service_os": "linux", "dst_port": "30000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "minikube_nodeport_emulated", "minikube_nodeport_payload", "net_kubernetes_probe", "tls_clienthello" ] }
08/06/2026 16:59:07 UTC	TCP	30000 · HTTP	http	Cross-site scripting xss attack · via HTTP:30000 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 30000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:30000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:30000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "5a272b52d803733b40b337616d90e9154af5129d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.432751473073671, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 30000, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "25b11e3da7071538c23c263eee87bfd68325c509", "event_fingerprint": "e9863f31424e435bf0b21118df73cccfd80bef15", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "33e564c0437746c0309069e83ae710e8", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 30000, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "959a83a6628d30cce51f3e0d1e301890ddd8c379", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 30000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:30000 \u00b7 (tentative d'exploit)", "target_port_label": "30000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 30000, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 30000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:30000 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "30000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "30000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "minikube-nodeport" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 16:29:18 UTC	TCP	4432 · TLS	tls	Sonde TLS tls probe · via TLS:4432 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4432 Chemin / cible — Service TLS Payload �1�ƍK�Θ�j0Le^<�b�3h�`�� ک g��S�G��o��-Z/=mCSI�sF\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �1�ƍK�Θ�j0Le^<�b�3h�`�� ک g��S�G��o��-Z/=mCSI�sF\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �1�ƍK�Θ�j0Le^<�b�3h�`�� ک g��S�G��o��-Z/=mCSI�sF\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.307673919339784, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 4432, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "798c6a817f25363160369fb926ca69b2dbc4368d", "event_fingerprint": "b334f6799b52a2683759e8a873cb93ad68de1730", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "63db4a61e759b96b6bf78205da539032", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 4432, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd\u00143h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\u0013\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\u001d\ufffdo\ufffd\ufffd\u0005\ufffd-Z\/=m\u001eCSI\ufffdsF\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd\u00143h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\u0013\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\u001d\ufffdo\ufffd\ufffd\u0005\ufffd-Z\/=m\u001eCSI\ufffdsF\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd\u00143h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\u0013\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\u001d\ufffdo\ufffd\ufffd\u0005\ufffd-Z\/=m\u001eCSI\ufffdsF\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ec91c4226a55249a37458d4a151bf5717617c298", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd\u00143h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\u0013\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\u001d\ufffdo\ufffd\ufffd\u0005\ufffd-Z\/=m\u001eCSI\ufffdsF\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 4432, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd1\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd3h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd-Z\/=mCSI\ufffdsF\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:4432 \u00b7 (sonde \/ probe)", "target_port_label": "4432 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4432, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd\u00143h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\u0013\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\u001d\ufffdo\ufffd\ufffd\u0005\ufffd-Z\/=m\u001eCSI\ufffdsF\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 4432, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:4432 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd1\ufffd\u018dK\ufffd\u0398\ufffdj0Le^<\ufffdb\ufffd3h\ufffd`\ufffd\ufffd \ufffd\ufffd\ufffd\n\u06a9 g\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffdG\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd-Z\/=mCSI\ufffdsF\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "4432 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
08/06/2026 16:29:18 UTC	TCP	4432 · HTTP	http	Cross-site scripting xss attack · via HTTP:4432 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4432 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4432 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4432 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "624f1b54bec68fdcec6d50cac2ddcae305b5f82b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451482556118708, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 4432, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b3c9a5b184a16a1e47a0d8bb0570e2bcacf60e33", "event_fingerprint": "8c928ca59fa892b39df88c4ce93d8a0fd5a092f0", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "1bd854305193f5f3307dfb84220331a0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 4432, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e84ab88a908da676895746e2db721bd2d213f936", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4432, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:4432 \u00b7 (tentative d'exploit)", "target_port_label": "4432 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4432, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4432, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:4432 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4432\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "4432 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 14:47:12 UTC	TCP	4443 · PHAROS	pharos	pharos pharos · via PHAROS:4443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur PHAROS WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4443 Chemin / cible — Service PHAROS Payload �?\|�� B��gH+��pڒ�aٝSc�� f�!�q��>��i]�KzC�{�.��h��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �?\|�� B��gH+��pڒ�aٝSc�� f�!�q��>��i]�KzC�{�.��h��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �?\|�� B��gH+��pڒ�aٝSc�� f�!�q��>��i]�KzC�{�.��h��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.320640573661037, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "pharos", "app_proto": "pharos", "asn": 209896, "country": "US", "dst_port": 4443, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02", "event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "pharos", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "59bcb3b34c6961b53e89f36108ccf41a", "path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a" }, "target_context": { "dst_port": 4443, "service": "pharos", "service_name": "pharos", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\u0015\ufffdgH+\ufffd\ufffd\ufffd\u0013p\u0692\ufffda\u065dSc\ufffd\u001c\ufffd \ufffd\u0003\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffd\u001dKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\u0015\ufffdgH+\ufffd\ufffd\ufffd\u0013p\u0692\ufffda\u065dSc\ufffd\u001c\ufffd \ufffd\u0003\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffd\u001dKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\u0015\ufffdgH+\ufffd\ufffd\ufffd\u0013p\u0692\ufffda\u065dSc\ufffd\u001c\ufffd \ufffd\u0003\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffd\u001dKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef0cd4d3849df3e8dcdb9e3dea19e29e48b3a1d6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\u0015\ufffdgH+\ufffd\ufffd\ufffd\u0013p\u0692\ufffda\u065dSc\ufffd\u001c\ufffd \ufffd\u0003\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffd\u001dKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 4443, "service": "pharos", "service_label_fr": "PHAROS" }, "evidence_snippet": "\ufffd?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdgH+\ufffd\ufffd\ufffdp\u0692\ufffda\u065dSc\ufffd\ufffd \ufffd\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffdKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)", "target_port_label": "4443 \u00b7 PHAROS", "emulator_service": "pharos", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "pharos", "service_label_fr": "PHAROS", "dst_port": 4443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-pharos", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\u0015\ufffdgH+\ufffd\ufffd\ufffd\u0013p\u0692\ufffda\u065dSc\ufffd\u001c\ufffd \ufffd\u0003\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffd\u001dKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 4443, "service": "pharos", "service_label_fr": "PHAROS" }, "attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd?\|\ufffd\ufffd \ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdgH+\ufffd\ufffd\ufffdp\u0692\ufffda\u065dSc\ufffd\ufffd \ufffd\ufffdf\ufffd!\ufffdq\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffdi]\ufffdKzC\ufffd{\ufffd.\ufffd\ufffdh\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "4443 \u00b7 PHAROS", "emulator_service": "pharos", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "pharos", "service_banner": "honeypot-pharos", "service_os": "linux", "dst_port": "4443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
08/06/2026 14:47:12 UTC	TCP	4443 · HTTP	http	Cross-site scripting xss attack · via HTTP:4443 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4443 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "e950df8a5a68e4dcc53c2ea4813456e73c1d6fc9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.446720314189158, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 4443, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 44, "tag_count": 4, "anomaly_count": 0, "campaign_key": "86a0523bbdc88d9b5281a1f9b77b738e907e16bd", "event_fingerprint": "484cf7cd799456a2cdb8011581d797a96c5f3939", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "660335949fe67aafee05232a7368644c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 4443, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "552adb1a8c4bd26eddf5238880f2ed80b15f5236", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:4443 \u00b7 (tentative d'exploit)", "target_port_label": "4443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4443, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:4443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "4443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "pharos" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
08/06/2026 11:33:36 UTC	TCP	8445 · TLS	tls	Sonde TLS tls probe · via TLS:8445 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8445 Chemin / cible — Service TLS Payload �:� �lW�<�D��o�Ȣ��ܴ𪷼�{�� i!��͙2��}Gj��d�U ��T4Z�#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �:� �lW�<�D��o�Ȣ��ܴ𪷼�{�� i!��͙2��}Gj��d�U��T4Z�#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �:� �lW�<�D��o�Ȣ��ܴ𪷼�{�� i!��͙2��}Gj��d�U ��T4Z�#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.327846955206073, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 8445, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fba38675657fa21af923b3776d72e0ef91da55b8", "event_fingerprint": "79ab92a64e975c20aaa08d157cfe6d49dc2c5040", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "41a0c7751dabd2dccce88c9745f66e60", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8445, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003:\ufffd\n\ufffd\u0019lW\ufffd\u0015<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\u0006\ufffd\u0734\ud86b\uddfc\u001c\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd\u000f}Gj\ufffd\ufffd\ufffdd\ufffdU\u000b\ufffd\ufffd\ufffdT4Z\ufffd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003:\ufffd\n\ufffd\u0019lW\ufffd\u0015<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\u0006\ufffd\u0734\ud86b\uddfc\u001c\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd\u000f}Gj\ufffd\ufffd\ufffdd\ufffdU\u000b\ufffd\ufffd\ufffdT4Z\ufffd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003:\ufffd\n\ufffd\u0019lW\ufffd\u0015<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\u0006\ufffd\u0734\ud86b\uddfc\u001c\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd\u000f}Gj\ufffd\ufffd\ufffdd\ufffdU\u000b\ufffd\ufffd\ufffdT4Z\ufffd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24087c26f0c422abf88c122d6c108dbc1f57b917", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003:\ufffd\n\ufffd\u0019lW\ufffd\u0015<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\u0006\ufffd\u0734\ud86b\uddfc\u001c\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd\u000f}Gj\ufffd\ufffd\ufffdd\ufffdU\u000b\ufffd\ufffd\ufffdT4Z\ufffd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8445, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd:\ufffd\n\ufffdlW\ufffd<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\ufffd\u0734\ud86b\uddfc\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd}Gj\ufffd\ufffd\ufffdd\ufffdU\ufffd\ufffd\ufffdT4Z\ufffd#\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8445 \u00b7 (sonde \/ probe)", "target_port_label": "8445 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8445, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003:\ufffd\n\ufffd\u0019lW\ufffd\u0015<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\u0006\ufffd\u0734\ud86b\uddfc\u001c\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd\u000f}Gj\ufffd\ufffd\ufffdd\ufffdU\u000b\ufffd\ufffd\ufffdT4Z\ufffd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8445, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8445 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd:\ufffd\n\ufffdlW\ufffd<\ufffdD\ufffd\ufffdo\ufffd\u0222\ufffd\ufffd\u0734\ud86b\uddfc\ufffd{\ufffd\ufffd \ufffd\ufffdi!\ufffd\ufffd\ufffd\u03592\ufffd\ufffd}Gj\ufffd\ufffd\ufffdd\ufffdU\ufffd\ufffd\ufffdT4Z\ufffd#\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8445 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8445" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
08/06/2026 11:33:36 UTC	TCP	8445 · HTTP	http	Cross-site scripting xss attack · via HTTP:8445 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8445 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8445 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8445 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.45378752989952, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 8445, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b41e2dd4443713c9331766f0cd01020bd052211e", "event_fingerprint": "607df22eab72bd97cea29dc8cc54f6d79cad734b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "bd4c07499a00e64bbf8b9113d03c41b9", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8445, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "80e8d495466c9b71b8e0290b8372d7ce72c2e7cb", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8445, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8445 \u00b7 (tentative d'exploit)", "target_port_label": "8445 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8445, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8445, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8445 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8445 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8445" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 10:28:56 UTC	TCP	12345 · NETBUS	netbus	netbus netbus · via NETBUS:12345 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur NETBUS WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12345 Chemin / cible — Service NETBUS Payload �,��[��\X6�b��ŭp��ۍi�_ (l�R (�fOq��4�m�>��0=' o��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « netbus » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �,��[��\X6�b��ŭp��ۍi�_ (l�R (�fOq��4�m�>��0=' o��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �,��[��\X6�b��ŭp��ۍi�_ (l�R (�fOq��4�m�>��0=' o��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a", "emulator_response_len": 38, "bytes_in": 517, "payload_entropy": 4.279582737711207, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "netbus", "app_proto": "netbus", "asn": 209896, "country": "US", "dst_port": 12345, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "079d3783c89882740825bb1b9437fe3a4aa1dcf2", "event_fingerprint": "c6571097010435c153412a411c447fe1f59a908c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "netbus", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eec55a232cea36e683b8f06da2072369", "path_pattern_hash": "468401074b03b78a88c623408feffd46" }, "target_context": { "dst_port": 12345, "service": "netbus", "service_name": "netbus", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\u0002\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cd\u000ei\u0012\ufffd\u0014_\u0006 (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\u0001\ufffd0=' o\ufffd\ufffd\ufffd\u0007\u0006\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\u0002\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cd\u000ei\u0012\ufffd\u0014_\u0006 (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\u0001\ufffd0=' o\ufffd\ufffd\ufffd\u0007\u0006\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\u0002\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cd\u000ei\u0012\ufffd\u0014_\u0006 (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\u0001\ufffd0=' o\ufffd\ufffd\ufffd\u0007\u0006\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "867d5a544c35dc00826710439c86d786c5e67bbf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\u0002\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cd\u000ei\u0012\ufffd\u0014_\u0006 (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\u0001\ufffd0=' o\ufffd\ufffd\ufffd\u0007\u0006\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 12345, "service": "netbus", "service_label_fr": "NETBUS" }, "evidence_snippet": "\ufffd,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cdi\ufffd_ (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\ufffd0=' o\ufffd\ufffd\ufffd\/\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "netbus \u00b7 via NETBUS:12345 \u00b7 (sonde \/ probe)", "target_port_label": "12345 \u00b7 NETBUS", "emulator_service": "netbus", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "netbus", "service_label_fr": "NETBUS", "dst_port": 12345, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-netbus", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\u0002\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cd\u000ei\u0012\ufffd\u0014_\u0006 (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\u0001\ufffd0=' o\ufffd\ufffd\ufffd\u0007\u0006\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 12345, "service": "netbus", "service_label_fr": "NETBUS" }, "attack_vector": "netbus \u00b7 via NETBUS:12345 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd,\ufffd\ufffd[\ufffd\ufffd\\X6\ufffdb\ufffd\ufffd\ufffd\ufffd\u016dp\ufffd\ufffd\ufffd\ufffd\u06cdi\ufffd_ (l\ufffdR (\ufffdfOq\ufffd\ufffd4\ufffdm\ufffd>\ufffd\ufffd0=*' o\ufffd\ufffd\ufffd\/\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "12345 \u00b7 NETBUS", "emulator_service": "netbus", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "netbus", "service_banner": "honeypot-netbus", "service_os": "linux", "dst_port": "12345" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
08/06/2026 10:28:56 UTC	TCP	12345 · NETBUS	netbus	Cross-site scripting xss attack · via NETBUS:12345 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur NETBUS WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12345 Chemin / cible — Service NETBUS Payload GET / HTTP/1.1 Host: 62.3.50.33:12345 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12345 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12345 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a", "emulator_response_len": 38, "bytes_in": 400, "payload_entropy": 5.45404161443526, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "netbus", "app_proto": "netbus", "asn": 209896, "country": "US", "dst_port": 12345, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "2a8591f17a74cbf579eca5d57133d975e28026dd", "event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 43 }, "named_classification_skipped": false, "service_name": "netbus", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "802e9b870e502629c4b6921364b527d5", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 12345, "service": "netbus", "service_name": "netbus", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d3000955c91e2fa0505e3e47aedfc64d57b88ee9", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "port": 12345, "service": "netbus", "service_label_fr": "NETBUS" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)", "target_port_label": "12345 \u00b7 NETBUS", "emulator_service": "netbus", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via NETBUS", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 43 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "netbus", "service_label_fr": "NETBUS", "dst_port": 12345, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-netbus", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "port": 12345, "service": "netbus", "service_label_fr": "NETBUS" }, "attack_vector": "xss attack \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "12345 \u00b7 NETBUS", "emulator_service": "netbus", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "netbus", "service_banner": "honeypot-netbus", "service_os": "linux", "dst_port": "12345" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
08/06/2026 10:08:37 UTC	TCP	8089 · HTTP	http	Cross-site scripting xss attack · via HTTP:8089 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8089 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8089 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8089 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.45345783595266, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 8089, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 47, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5e256504645230307d620ce3e464b977231d017e", "event_fingerprint": "de936a6432fb89a855da618305ffe2db3df65c5f", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "518e9b67162e827d668d397ce5be79a9", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8089, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f7ebeb6264687fe3dac0a940d343470d22c5ccb5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8089, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit)", "target_port_label": "8089 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8089, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8089, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8089 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8089" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "splunk", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
08/06/2026 10:08:36 UTC	TCP	8089 · SPLUNK	splunk	splunk splunk · via SPLUNK:8089 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur SPLUNK WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8089 Chemin / cible — Service SPLUNK Payload �8�<0��Xz?�� I+��z�GN/IMS��P P�/�+��}�)�Q�$��tIt =�䅦B_�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �8�<0��Xz?�� I+��z�GN/IMS��P P�/�+��}�)�Q�$��tIt=�䅦B_�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �8�<0��Xz?�� I+��z�GN/IMS��P P�/�+��}�)�Q�$��tIt =�䅦B_�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.276668977652272, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "splunk", "app_proto": "splunk", "asn": 209896, "country": "US", "dst_port": 8089, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07", "event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "splunk", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f41fb74e11bae20bf3f79b244fe69de8", "path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f" }, "target_context": { "dst_port": 8089, "service": "splunk", "service_name": "splunk", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00148\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdG\u0015N\/\u001bIMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd\u0006)\ufffdQ\u001c\ufffd$\ufffd\ufffd\ufffdtIt\u000b=\ufffd\u4166B_\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00148\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdG\u0015N\/\u001bIMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd\u0006)\ufffdQ\u001c\ufffd$\ufffd\ufffd\ufffdtIt\u000b=\ufffd\u4166B_\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00148\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdG\u0015N\/\u001bIMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd\u0006)\ufffdQ\u001c\ufffd$\ufffd\ufffd\ufffdtIt\u000b=\ufffd\u4166B_\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1f46b7e67db074dcc6476aafe5d542ef3a5d637", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00148\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdG\u0015N\/\u001bIMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd\u0006)\ufffdQ\u001c\ufffd$\ufffd\ufffd\ufffdtIt\u000b=\ufffd\u4166B_\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8089, "service": "splunk", "service_label_fr": "SPLUNK" }, "evidence_snippet": "\ufffd8\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdGN\/IMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd)\ufffdQ\ufffd$\ufffd\ufffd\ufffdtIt=\ufffd\u4166B_\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)", "target_port_label": "8089 \u00b7 SPLUNK", "emulator_service": "splunk", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "splunk", "service_label_fr": "SPLUNK", "dst_port": 8089, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-splunk", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00148\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdG\u0015N\/\u001bIMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd\u0006)\ufffdQ\u001c\ufffd$\ufffd\ufffd\ufffdtIt\u000b=\ufffd\u4166B_\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8089, "service": "splunk", "service_label_fr": "SPLUNK" }, "attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd8\ufffd<0\ufffd\ufffd\ufffdXz?\ufffd\ufffd \ufffdI+\ufffd\ufffdz\ufffdGN\/IMS\ufffd\ufffdP P\ufffd\/\ufffd+\ufffd\ufffd\ufffd}\ufffd)\ufffdQ\ufffd$\ufffd\ufffd\ufffdtIt=\ufffd\u4166B_\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8089 \u00b7 SPLUNK", "emulator_service": "splunk", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "splunk", "service_banner": "honeypot-splunk", "service_os": "linux", "dst_port": "8089" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "splunk", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
08/06/2026 10:05:41 UTC	TCP	14433 · TLS	tls	Sonde TLS tls probe · via TLS:14433 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14433 Chemin / cible — Service TLS Payload ��RDʅ�$�[�[喝:W�>�󆞌hع Ά�� Sح�{fo��Q��n4�cT�P��CpW\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��RDʅ�$�[�[喝:W�>�󆞌hع Ά�� Sح�{fo��Q��n4�cT�P��CpW\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��RDʅ�$�[�[喝:W�>�󆞌hع Ά�� Sح�{fo��Q��n4�cT�P��CpW\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.291035393872567, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 14433, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "642d2c6dd3590e35fc1bc37d810583c704f46642", "event_fingerprint": "0bb80e207668beebbf93cdb286a4479a64ee54b4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "30e2f63440ac876b661bf204ddabf5ef", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 14433, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a76b879980e72fa0290908d4199dda0ea5995afd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 14433, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdRD\u0285\ufffd$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:14433 \u00b7 (sonde \/ probe)", "target_port_label": "14433 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14433, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0017\ufffdRD\u0285\ufffd\u001b$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\u0003\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 14433, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:14433 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdRD\u0285\ufffd$\ufffd[\ufffd[\ufa36:W\ufffd>\ufffd\udad9\udf8ch\u0639 \u0386\ufffd\ufffd\ufffd\n\ufffdS\u062d\ufffd{fo\ufffd\ufffdQ\ufffd\ufffdn4\ufffdcT\ufffdP\ufffd\ufffd\ufffdCpW\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "14433 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
08/06/2026 10:05:41 UTC	TCP	14433 · HTTP	http	Cross-site scripting xss attack · via HTTP:14433 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 14433 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:14433 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:14433 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "685db216b5b0db8a290c1710c090e48842318293", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.447316724595528, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 14433, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "48c520270e1fc43e69264f62665e7e249f83beae", "event_fingerprint": "1797189aee22d986f05f8b3aa22da1b708317fcd", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "3a8abd239693a751a72af7fbb586c488", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 14433, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1d6e3886dc979251c14c41eccebee1931928453", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 14433, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:14433 \u00b7 (tentative d'exploit)", "target_port_label": "14433 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 14433, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 14433, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:14433 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:14433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "14433 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "14433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 09:43:47 UTC	TCP	4433 · QUIC HTTP3 STUB	quic-http3-stub	Cross-site scripting xss attack · via QUIC HTTP3 STUB:4433 · (tentative d'exploit)	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur QUIC-HTTP3-STUB WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_quic_probe quic_http3_stub_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4433 Chemin / cible — Service QUIC HTTP3 STUB Payload GET / HTTP/1.1 Host: 62.3.50.33:4433 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4433 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4433 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "0c00000000485454502f3320686f6e6579706f7420737475620d0a", "emulator_response_len": 27, "bytes_in": 399, "payload_entropy": 5.444740811918476, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "quic-http3-stub", "app_proto": "quic-http3-stub", "asn": 209896, "country": "US", "dst_port": 4433, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "14d92daaaff81dcfbde8a9049295b48b4a641fa5", "event_fingerprint": "69ec763c111675fc5207ef508e4abdef0f3279d4", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 42 }, "named_classification_skipped": false, "service_name": "quic-http3-stub", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "62d42640ee8699bbbdcc25b8f725a2af", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 4433, "service": "quic-http3-stub", "service_name": "quic-http3-stub", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "efa66c3374457375c33869aa19ce3ba3135bc034", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 4433, "service": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (tentative d'exploit)", "target_port_label": "4433 \u00b7 QUIC HTTP3 STUB", "emulator_service": "quic-http3-stub", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via QUIC HTTP3 STUB", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 42 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB", "dst_port": 4433, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-quic-http3-stub", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 4433, "service": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB" }, "attack_vector": "xss attack \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4433\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "4433 \u00b7 QUIC HTTP3 STUB", "emulator_service": "quic-http3-stub", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "quic_http3_stub", "service_banner": "honeypot-quic-http3-stub", "service_os": "linux", "dst_port": "4433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_quic_probe", "quic_http3_stub_emulated", "quic_http3_stub_payload" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 09:43:46 UTC	TCP	4433 · QUIC HTTP3 STUB	quic-http3-stub	quic probe quic probe · via QUIC HTTP3 STUB:4433 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur QUIC-HTTP3-STUB WAF — Recommandation Surveiller Tags net_quic_probe quic_http3_stub_emulated quic_http3_stub_payload tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4433 Chemin / cible — Service QUIC HTTP3 STUB Payload �P�}�� ]Axc �zĴ��^�I��:V� 9�ܵ��b[{<�0�6@�Ь�;O��랟�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « quic_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 42 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �P�}��]Axc�zĴ��^�I��:V� 9�ܵ��b[{<�0�6@�Ь�;O��랟�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �P�}�� ]Axc �zĴ��^�I��:V� 9�ܵ��b[{<�0�6@�Ь�;O��랟�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "0c00000000485454502f3320686f6e6579706f7420737475620d0a", "emulator_response_len": 27, "bytes_in": 517, "payload_entropy": 4.31732965329724, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "quic-http3-stub", "app_proto": "quic-http3-stub", "asn": 209896, "country": "US", "dst_port": 4433, "risk_waf": 8, "risk_classification": 40, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 40, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a8bd063f644b84e1de1a05db0b9f17e832ed6e2d", "event_fingerprint": "69ec763c111675fc5207ef508e4abdef0f3279d4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 40, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42 }, "service_name": "quic-http3-stub", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6a9276d0f63f9ad7a47b360ac08c73a2", "path_pattern_hash": "9e995d52485cdb3f5eaf00457847ee42" }, "target_context": { "dst_port": 4433, "service": "quic-http3-stub", "service_name": "quic-http3-stub", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffd}\u0007\ufffd\ufffd\ufffd\u000b]Axc\f\ufffdz\u0134\ufffd\ufffd\u001b^\u001e\ufffd\u0001\u001dI\ufffd\ufffd\u001f:V\ufffd 9\u0012\ufffd\u0735\u0018\u0006\ufffd\u001b\ufffdb[{<\ufffd0\ufffd6@\ufffd\b\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffd}\u0007\ufffd\ufffd\ufffd\u000b]Axc\f\ufffdz\u0134\ufffd\ufffd\u001b^\u001e\ufffd\u0001\u001dI\ufffd\ufffd\u001f:V\ufffd 9\u0012\ufffd\u0735\u0018\u0006\ufffd\u001b\ufffdb[{<\ufffd0\ufffd6@\ufffd\b\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffd}\u0007\ufffd\ufffd\ufffd\u000b]Axc\f\ufffdz\u0134\ufffd\ufffd\u001b^\u001e\ufffd\u0001\u001dI\ufffd\ufffd\u001f:V\ufffd 9\u0012\ufffd\u0735\u0018\u0006\ufffd\u001b\ufffdb[{<\ufffd0\ufffd6@\ufffd\b\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e267f2e220efe40b70e3346e4d18013d744432e1", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffd}\u0007\ufffd\ufffd\ufffd\u000b]Axc\f\ufffdz\u0134\ufffd\ufffd\u001b^\u001e\ufffd\u0001\u001dI\ufffd\ufffd\u001f:V\ufffd 9\u0012\ufffd\u0735\u0018\u0006\ufffd\u001b\ufffdb[{<\ufffd0\ufffd6@\ufffd\b\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 4433, "service": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB" }, "evidence_snippet": "\ufffdP\ufffd}\ufffd\ufffd\ufffd]Axc\ufffdz\u0134\ufffd\ufffd^\ufffdI\ufffd\ufffd:V\ufffd 9\ufffd\u0735\ufffd\ufffdb[{<\ufffd0\ufffd6@\ufffd\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)", "target_port_label": "4433 \u00b7 QUIC HTTP3 STUB", "emulator_service": "quic-http3-stub", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 40, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 42, "risk_label": "Moyen", "service_name": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB", "dst_port": 4433, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-quic-http3-stub", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffd}\u0007\ufffd\ufffd\ufffd\u000b]Axc\f\ufffdz\u0134\ufffd\ufffd\u001b^\u001e\ufffd\u0001\u001dI\ufffd\ufffd\u001f:V\ufffd 9\u0012\ufffd\u0735\u0018\u0006\ufffd\u001b\ufffdb[{<\ufffd0\ufffd6@\ufffd\b\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 4433, "service": "quic-http3-stub", "service_label_fr": "QUIC HTTP3 STUB" }, "attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdP\ufffd}\ufffd\ufffd\ufffd]Axc\ufffdz\u0134\ufffd\ufffd^\ufffdI\ufffd\ufffd:V\ufffd 9\ufffd\u0735\ufffd\ufffdb[{<\ufffd0\ufffd6@\ufffd\u042c\ufffd;O\ufffd\ufffd\ub79f\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "4433 \u00b7 QUIC HTTP3 STUB", "emulator_service": "quic-http3-stub", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "quic_http3_stub", "service_banner": "honeypot-quic-http3-stub", "service_os": "linux", "dst_port": "4433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_quic_probe", "quic_http3_stub_emulated", "quic_http3_stub_payload", "tls_clienthello" ] }
08/06/2026 07:46:01 UTC	TCP	5050 · TLS	tls	Sonde TLS tls probe · via TLS:5050 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5050 Chemin / cible — Service TLS Payload ��95N��s�#Z�,��!�q"8\|� �g\|b�� r�9d�$��xm .�܊�5��Qi��4\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��95N��s�#Z�,��!�q"8\|��g\|b�� r�9d�$��xm.�܊�5��Qi��4\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��95N��s�#Z�,��!�q"8\|� �g\|b�� r�9d�$��xm .�܊�5��Qi��4\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.306039087990829, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 5050, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fb3ef0e201d62008446dc989e903abd0238156a0", "event_fingerprint": "b55855327d6f328760279ca1199fdd7b9fe70e5e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "0ad0a576f316fd6a2fe8fe719b4d491d", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5050, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd95N\u001d\ufffd\ufffds\u0017\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\u001b\"8\|\ufffd\u000b\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9\u0017\u0019d\ufffd$\ufffd\ufffd\ufffdxm\f.\ufffd\u070a\ufffd5\ufffd\u0005\u0017\ufffdQi\ufffd\ufffd\ufffd4\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd95N\u001d\ufffd\ufffds\u0017\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\u001b\"8\|\ufffd\u000b\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9\u0017\u0019d\ufffd$\ufffd\ufffd\ufffdxm\f.\ufffd\u070a\ufffd5\ufffd\u0005\u0017\ufffdQi\ufffd\ufffd\ufffd4\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd95N\u001d\ufffd\ufffds\u0017\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\u001b\"8\|\ufffd\u000b\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9\u0017\u0019d\ufffd$\ufffd\ufffd\ufffdxm\f.\ufffd\u070a\ufffd5\ufffd\u0005\u0017\ufffdQi\ufffd\ufffd\ufffd4\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "71e309f47f22b916ceb2ef3462b16cd3f5371903", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd95N\u001d\ufffd\ufffds\u0017\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\u001b\"8\|\ufffd\u000b\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9\u0017\u0019d\ufffd$\ufffd\ufffd\ufffdxm\f.\ufffd\u070a\ufffd5\ufffd\u0005\u0017\ufffdQi\ufffd\ufffd\ufffd4\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5050, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd95N\ufffd\ufffds\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\"8\|\ufffd\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9d\ufffd$\ufffd\ufffd\ufffdxm.\ufffd\u070a\ufffd5\ufffd\ufffdQi\ufffd\ufffd\ufffd4\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)", "target_port_label": "5050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5050, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd95N\u001d\ufffd\ufffds\u0017\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\u001b\"8\|\ufffd\u000b\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9\u0017\u0019d\ufffd$\ufffd\ufffd\ufffdxm\f.\ufffd\u070a\ufffd5\ufffd\u0005\u0017\ufffdQi\ufffd\ufffd\ufffd4\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5050, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd95N\ufffd\ufffds\ufffd#Z\ufffd,\ufffd\ufffd!\ufffdq\"8\|\ufffd\ufffdg\|b\ufffd\ufffd \ufffdr\ufffd9d\ufffd$\ufffd\ufffd\ufffdxm.\ufffd\u070a\ufffd5\ufffd\ufffdQi\ufffd\ufffd\ufffd4\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "5050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
08/06/2026 07:46:01 UTC	TCP	5050 · HTTP	http	Cross-site scripting xss attack · via HTTP:5050 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5050 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "93cff2cb32142a67ac2a16e86c195a93c816d7e1", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.440432140281049, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 5050, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "425d6dd180461bff7fc4df85d2e1d9f71416a266", "event_fingerprint": "c3c4e321bf3097e1eed3ff62527804f1b2652e6c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "3156911bf87a6aa46f0ae7c192138b60", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5050, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5d067f9bc52bfbebb6cf8da0b5efc1431046491b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5050, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:5050 \u00b7 (tentative d'exploit)", "target_port_label": "5050 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5050, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5050, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5050 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5050 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 06:25:01 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	kafka-jmx kafka-jmx · via KAFKA JMX:9091 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Payload �,�2�ӑCM��S#�ԥ쟽�E�7��!��V T��`�he��f�Ubo#6�w�M��P��w\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « kafka-jmx » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �,�2�ӑCM��S#�ԥ쟽�E�7��!��V T��`�he��f�Ubo#6�w�M��P��w\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �,�2�ӑCM��S#�ԥ쟽�E�7��!��V T��`�he��f�Ubo#6�w�M��P��w\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "bytes_in": 517, "payload_entropy": 4.298201393240089, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 209896, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4f39d54b3867ce6827fbc2a6bad12f3e00fca027", "event_fingerprint": "c58ab12dc1fefd8340494c3b1522d2ff34dfdb9e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "kafka-jmx", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "90680ac1b2a0d0ea65397eca56858892", "path_pattern_hash": "b559ec958a47d0fa45debbf0f8ddb3e2" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\u0000\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\u001c\ufffd\ufffd\u0016f\ufffdUb\u001fo#6\ufffdw\ufffdM\ufffd\ufffdP\u0017\ufffd\ufffd\ufffdw\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\u0000\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\u001c\ufffd\ufffd\u0016f\ufffdUb\u001fo#6\ufffdw\ufffdM\ufffd\ufffdP\u0017\ufffd\ufffd\ufffdw\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\u0000\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\u001c\ufffd\ufffd\u0016f\ufffdUb\u001fo#6\ufffdw\ufffdM\ufffd\ufffdP\u0017\ufffd\ufffd\ufffdw\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a79b1528df9f3b8c8ce0678ab84f9cb4918a15ec", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\u0000\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\u001c\ufffd\ufffd\u0016f\ufffdUb\u001fo#6\ufffdw\ufffdM\ufffd\ufffdP\u0017\ufffd\ufffd\ufffdw\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "evidence_snippet": "\ufffd,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\ufffd\ufffdf\ufffdUbo#6\ufffdw\ufffdM\ufffd\ufffdP\ufffd\ufffd\ufffdw\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b,\ufffd2\ufffd\u04d1CM\ufffd\ufffdS#\u0000\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\u001c\ufffd\ufffd\u0016f\ufffdUb\u001fo#6\ufffdw\ufffdM\ufffd\ufffdP\u0017\ufffd\ufffd\ufffdw\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd,\ufffd*2\ufffd\u04d1CM\ufffd\ufffdS#\ufffd\u0525\uc7fd\ufffdE\ufffd7\ufffd\ufffd\ufffd!\ufffd\ufffdV T\ufffd\ufffd`\ufffdhe\ufffd\ufffdf\ufffdUbo#6\ufffdw\ufffdM\ufffd\ufffdP\ufffd\ufffd\ufffdw\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
08/06/2026 06:25:01 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	Cross-site scripting xss attack · via KAFKA JMX:9091 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Payload GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "bytes_in": 399, "payload_entropy": 5.448195015225568, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 209896, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a8c4adfa32f323ec2546809ab0e547456322600b", "event_fingerprint": "971ef2e8331e408f981a3d06d9f2f0499dd5d0ba", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 43 }, "named_classification_skipped": false, "service_name": "kafka-jmx", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "916a57aeab647bb5f450c5a1ce772e05", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "174201471b31655c7468aa01330d095a834822b3", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via KAFKA JMX:9091 \u00b7 (tentative d'exploit)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via KAFKA JMX", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 43 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "xss attack \u00b7 via KAFKA JMX:9091 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
08/06/2026 04:30:29 UTC	TCP	9009 · CLICKHOUSE NATIVE	clickhouse-native	Cross-site scripting xss attack · via CLICKHOUSE NATIVE:9009 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur CLICKHOUSE-NATIVE WAF — Recommandation Surveiller Tags clickhouse_native_emulated clickhouse_native_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9009 Chemin / cible — Service CLICKHOUSE NATIVE Payload GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a", "emulator_response_len": 35, "bytes_in": 399, "payload_entropy": 5.444216037535003, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "clickhouse-native", "app_proto": "clickhouse-native", "asn": 209896, "country": "US", "dst_port": 9009, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e7474adc33a37b56ed8e64e4fa3f6673c592e7a3", "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "clickhouse-native", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3680a9793fb69a0922cea6ab2641109a", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 9009, "service": "clickhouse-native", "service_name": "clickhouse-native", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94e43d260d09c19084f944b59739d94ca146fffa", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via CLICKHOUSE NATIVE", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE", "dst_port": 9009, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-clickhouse-native", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "attack_vector": "xss attack \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "clickhouse_native", "service_banner": "honeypot-clickhouse-native", "service_os": "linux", "dst_port": "9009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "clickhouse_native_emulated", "clickhouse_native_payload", "http_get_probe", "mozi_pattern", "net_clickhouse_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 04:30:28 UTC	TCP	9009 · CLICKHOUSE NATIVE	clickhouse-native	clickhouse probe clickhouse probe · via CLICKHOUSE NATIVE:9009 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CLICKHOUSE-NATIVE WAF — Recommandation Surveiller Tags clickhouse_native_emulated clickhouse_native_payload net_clickhouse_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9009 Chemin / cible — Service CLICKHOUSE NATIVE Payload �k��i��*x�� G$�[��VI� ��R�� c�k��ca��4SI%��f4H�8K\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �k��i��*x�� G$�[��VI� ��R�� c�k��ca��4SI%��f4H�8K\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �k��i��*x�� G$�[��VI� ��R�� c�k��ca��4SI%��f4H�8K\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a", "emulator_response_len": 35, "bytes_in": 517, "payload_entropy": 4.290169630455419, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "clickhouse-native", "app_proto": "clickhouse-native", "asn": 209896, "country": "US", "dst_port": 9009, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2091ee2955dc85106e8d0e5f3be8953750c2cf6e", "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "clickhouse-native", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9f5de025119b1f414bdbc728b48fabd7", "path_pattern_hash": "a6f7713503e08b2580844867d22bf612" }, "target_context": { "dst_port": 9009, "service": "clickhouse-native", "service_name": "clickhouse-native", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003k\ufffd\ufffd\ufffdi\ufffd\ufffd\u000f\u0004\u0005x\ufffd\ufffd\ufffd\u001e\u000f\u001d\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd\f \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4S\u0012I%\ufffd\u0006\ufffdf4H\ufffd8K\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003k\ufffd\ufffd\ufffdi\ufffd\ufffd\u000f\u0004*\u0005x\ufffd\ufffd\ufffd\u001e\u000f\u001d\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd\f \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4S\u0012I%\ufffd\u0006\ufffdf4H\ufffd8K\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003k\ufffd\ufffd\ufffdi\ufffd\ufffd\u000f\u0004\u0005x\ufffd\ufffd\ufffd\u001e\u000f\u001d\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd\f \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4S\u0012I%\ufffd\u0006\ufffdf4H\ufffd8K\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "40be34e3bd569c41b123d658a17938aab9a09484", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003k\ufffd\ufffd\ufffdi\ufffd\ufffd\u000f\u0004*\u0005x\ufffd\ufffd\ufffd\u001e\u000f\u001d\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd\f \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4S\u0012I%\ufffd\u0006\ufffdf4H\ufffd8K\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "evidence_snippet": "\ufffdk\ufffd\ufffd\ufffdi\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4SI%\ufffd\ufffdf4H\ufffd8K\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "clickhouse probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (sonde \/ probe)", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE", "dst_port": 9009, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-clickhouse-native", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003k\ufffd\ufffd\ufffdi\ufffd\ufffd\u000f\u0004*\u0005x\ufffd\ufffd\ufffd\u001e\u000f\u001d\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd\f \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4S\u0012I%\ufffd\u0006\ufffdf4H\ufffd8K\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "attack_vector": "clickhouse probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdk\ufffd\ufffd\ufffdi\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\rG$\ufffd[\ufffd\ufffdVI\ufffd \ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\rc\ufffdk\ufffd\ufffdca\ufffd\ufffd\ufffd4SI%\ufffd\ufffdf4H\ufffd8K\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "clickhouse_native", "service_banner": "honeypot-clickhouse-native", "service_os": "linux", "dst_port": "9009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "clickhouse_native_emulated", "clickhouse_native_payload", "net_clickhouse_probe", "tls_clienthello" ] }
07/06/2026 22:56:36 UTC	TCP	883 · TLS	tls	Sonde TLS tls probe · via TLS:883 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 883 Chemin / cible — Service TLS Payload �� q��O��n�X�~�z$�y@P� �_B��E^Q�P刬,_��)��X]q�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �� q��O��n�X�~�z$�y@P� �_B��E^Q�P刬,_��)��X]q�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �� q��O��n�X�~�z$�y@P� �_B��E^Q�P刬,_��)��X]q�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.274914932858447, "port_category": "well_known", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 883, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "35e440f457021110d638b840b2bf1addc78d5dc8", "event_fingerprint": "f41bcd07de768d0e3aac38865e755937e7a5056e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "c298ad2b3498d5933f26ce9d8ed4b4bb", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 883, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0003\ufffd\u0000\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd\u0007 \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\u0013\u001a\u000f\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\u001cX]q\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0003\ufffd\u0000\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd\u0007 \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\u0013\u001a\u000f\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\u001cX]q\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0003\ufffd\u0000\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd\u0007 \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\u0013\u001a\u000f\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\u001cX]q\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f2813e91dbd800eda2412bc3bae1d1f20ca9bce9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0003\ufffd\u0000\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd\u0007 \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\u0013\u001a\u000f\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\u001cX]q\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 883, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdX]q\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:883 \u00b7 (sonde \/ probe)", "target_port_label": "883 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 883, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0003\ufffd\u0000\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd\u0007 \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\u0013\u001a\u000f\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\u001cX]q\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 883, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:883 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffdn\ufffdX\ufffd~\ufffdz$\ufffdy@P\ufffd \ufffd_B\ufffd\ufffdE^Q\ufffdP\u522c,_\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdX]q\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "883 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "883" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 22:56:36 UTC	TCP	883 · HTTP	http	Cross-site scripting xss attack · via HTTP:883 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 883 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:883 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:883 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apn Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "0ddbf70b6778849f8d2fd9368d30d4a713d229ad", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 398, "payload_entropy": 5.450151444183752, "port_category": "well_known", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 883, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0083b25ba799bab5e2ed2a476404bb3cd4889797", "event_fingerprint": "a6ad0d32cbd1ddfeb849acde8e6434f7bcea6489", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "146953cfee6c9cc5d4ee1bd39d0d7a6c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 883, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f35e9def121b8d59ab755adc2ccd0306c8a31b91", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 883, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "attack_vector": "xss attack \u00b7 via HTTP:883 \u00b7 (tentative d'exploit)", "target_port_label": "883 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 883, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 883, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:883 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:883\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "target_port_label": "883 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "883" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 21:23:18 UTC	TCP	6000 · TLS	tls	Sonde TLS tls probe · via TLS:6000 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6000 Chemin / cible — Service TLS Payload �1c� �+��L��]�WE�v��ى�.�SGS2�� j��iK%ߜӒ��O?�^L� ׼�2�$��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �1c��+��L��]�WE�v��ى�.�SGS2�� j��iK%ߜӒ��O?�^L�׼�2�$��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �1c� �+��L��]�WE�v��ى�.�SGS2�� j��iK%ߜӒ��O?�^L� ׼�2�$��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.3313838117133185, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 6000, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "02e811be5bb54dede32290f05478455a42ee8958", "event_fingerprint": "46018561e6904cb2a876932f6c7222461078aafa", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "6ecee3a04ad63bfa876649ce95bb1cc5", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 6000, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031c\ufffd\f\ufffd+\u001b\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdS\u000eGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\u0013\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u000b\u05fc\ufffd2\ufffd\u001b$\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031c\ufffd\f\ufffd+\u001b\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdS\u000eGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\u0013\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u000b\u05fc\ufffd2\ufffd\u001b$\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031c\ufffd\f\ufffd+\u001b\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdS\u000eGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\u0013\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u000b\u05fc\ufffd2\ufffd\u001b$\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0b2b42365486c7cf3dd09669868b050fed64ec3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031c\ufffd\f\ufffd+\u001b\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdS\u000eGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\u0013\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u000b\u05fc\ufffd2\ufffd\u001b$\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 6000, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd1c\ufffd\ufffd+\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdSGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u05fc\ufffd2\ufffd$\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)", "target_port_label": "6000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6000, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031c\ufffd\f\ufffd+\u001b\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdS\u000eGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\u0013\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u000b\u05fc\ufffd2\ufffd\u001b$\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 6000, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd1c\ufffd\ufffd+\ufffd\ufffdL\ufffd\ufffd]\ufffdWE\ufffdv\ufffd\ufffd\u0649\ufffd.\ufffdSGS2\ufffd\ufffd j\ufffd\ufffd\ufffd\ufffd\ufffdiK%\u07dc\u04d2\ufffd\ufffdO?\ufffd^L\ufffd\u05fc\ufffd2\ufffd$\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "6000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 21:23:18 UTC	TCP	6000 · HTTP	http	Cross-site scripting xss attack · via HTTP:6000 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "9d347d028c377ce68c7f996bd692f8cf5d190493", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.436194672734973, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 6000, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6b4c8b6e96a240220f2b9694459258d403aa7692", "event_fingerprint": "e2298b1a772c2e4c565aaed2f4c19c3d40cdd98a", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "453ae3f238b31f17a728939e44c80126", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6000, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "72ec1ed16fad16e77f2d432dc752968f2bc9a72a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 6000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:6000 \u00b7 (tentative d'exploit)", "target_port_label": "6000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6000, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 6000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:6000 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "6000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 21:09:31 UTC	TCP	9999 · ADMIN ALT	admin-alt	admin-alt admin-alt · via ADMIN ALT:9999 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur ADMIN-ALT WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9999 Chemin / cible — Service ADMIN ALT Payload ��)��>.��l��JOgՓY2��q{� �� 4��'��9r��ŗ�-�I��#�f�,�p!�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « admin-alt » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��)��>.��l��JOgՓY2��q{� �� 4��'��9r��ŗ�-�I��#�f�,�p!�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��)��>.��l��JOgՓY2��q{� �� 4��'��9r��ŗ�-�I��#�f�,�p!�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.3262612316694495, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "admin-alt", "app_proto": "admin-alt", "asn": 209896, "country": "US", "dst_port": 9999, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "71e0a038aaec3062d9b3f018bb65ab92d2779b4c", "event_fingerprint": "bdae3a5e708dccdbe307a2861747dd09885f206a", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "admin-alt", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f709831e61d7260dd88bc85c736b959", "path_pattern_hash": "d3aaa0a3d94e4e5a70802f7b7e17f9f7" }, "target_context": { "dst_port": 9999, "service": "admin-alt", "service_name": "admin-alt", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd)\ufffd\ufffd\u0013>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u000f\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\u0012\ufffd\ufffd\u0157\ufffd\u0005-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd)\ufffd\ufffd\u0013>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u000f\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\u0012\ufffd\ufffd\u0157\ufffd\u0005-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd)\ufffd\ufffd\u0013>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u000f\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\u0012\ufffd\ufffd\u0157\ufffd\u0005-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ba28e91bf26ac24f0079061708db46699fffedbc", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd)\ufffd\ufffd\u0013>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u000f\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\u0012\ufffd\ufffd\u0157\ufffd\u0005-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9999, "service": "admin-alt", "service_label_fr": "ADMIN ALT" }, "evidence_snippet": "\ufffd\ufffd\ufffd)\ufffd\ufffd>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\ufffd\ufffd\u0157\ufffd-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)", "target_port_label": "9999 \u00b7 ADMIN ALT", "emulator_service": "admin-alt", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "admin-alt", "service_label_fr": "ADMIN ALT", "dst_port": 9999, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-admin-alt", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd)\ufffd\ufffd\u0013>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u000f\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd\ufffd9r\u0012\ufffd\ufffd\u0157\ufffd\u0005-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 9999, "service": "admin-alt", "service_label_fr": "ADMIN ALT" }, "attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd)\ufffd\ufffd>.\ufffd\ufffdl\ufffd\ufffd\ufffdJOg\u0553Y2\ufffd\ufffdq{\ufffd\r\ufffd\ufffd 4\ufffd\ufffd'\ufffd*\ufffd9r\ufffd\ufffd\u0157\ufffd-\ufffdI\ufffd\ufffd#\ufffdf\ufffd,\ufffdp\u008f!\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9999 \u00b7 ADMIN ALT", "emulator_service": "admin-alt", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "admin_alt", "service_banner": "honeypot-admin-alt", "service_os": "linux", "dst_port": "9999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
07/06/2026 21:09:31 UTC	TCP	9999 · HTTP	http	Cross-site scripting xss attack · via HTTP:9999 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9999 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9999 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9999 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "83a22baaf629d53e39c79d30e6b18dca9da1a92c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451167525995719, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 9999, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "aa0d080d5f055349ccfe5818e9c44f4a4640be4f", "event_fingerprint": "40878c406b78c3c05ae157428aaa7e6fc39c6cac", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "71db7fbbfa040c06f3b0abcedecc8979", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9999, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a950e6acff8f7a5302b9936d9dbcdeed9e7a33b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9999, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "admin-alt", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
07/06/2026 19:56:21 UTC	TCP	9526 · TLS	tls	Sonde TLS tls probe · via TLS:9526 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9526 Chemin / cible — Service TLS Payload �_k��;��Kd�f��?��S��8�d��Z� ��q��+.�r� ��2�AYk.h��W�3\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �_k��;��Kd�f��?��S��8�d��Z� ��q��+.�r� ��2�AYk.h��W�3\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �_k��;��Kd�f��?��S��8�d��Z� ��q��+.�r� ��2�AYk.h��W�3\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.3211025290914575, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 9526, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d63c3eb8e6eb2807dc9a4c67488d9e9f628c289f", "event_fingerprint": "e03e4ea46fb826b92bf7c19f45ac57c653a6298a", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "27c470271e78a0e04d30906699f8d8a2", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 9526, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\u0017\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\f\ufffd\ufffd\u000f\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\u0016\ufffd3\u0015\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\u0017\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\f\ufffd\ufffd\u000f\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\u0016\ufffd3\u0015\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\u0017\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\f\ufffd\ufffd\u000f\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\u0016\ufffd3\u0015\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b4b7b278fc80c798b941150e6e70d58a35bfd83", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\u0017\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\f\ufffd\ufffd\u000f\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\u0016\ufffd3\u0015\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9526, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\ufffd\ufffd\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\ufffd3\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:9526 \u00b7 (sonde \/ probe)", "target_port_label": "9526 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9526, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\u0017\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\f\ufffd\ufffd\u000f\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\u0016\ufffd3\u0015\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9526, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:9526 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd_k\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdKd\ufffdf\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdS\ufffd\ufffd8\ufffdd\ufffd\ufffdZ\ufffd \ufffd\ufffdq\ufffd\ufffd+.\ufffdr\ufffd\n\ufffd\ufffd\ufffd\ufffd2\ufffdAYk.h\ufffd\ufffdW\ufffd3\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9526 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9526" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 19:56:21 UTC	TCP	9526 · HTTP	http	Cross-site scripting xss attack · via HTTP:9526 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9526 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9526 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9526 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "aa6455a66191bcb9b4317a368bfe08abeac104e1", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.454288108697063, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 9526, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c524bd05011ee6a16abdfd3aa4a94029844bbfbb", "event_fingerprint": "a0c04f842b0484a4d376db9d9c2582d635af1f54", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "4fceb211b55d556664d7816b6e41f354", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9526, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59e89b9e31725746b06a3a103b1282c8a95ec90a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9526, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9526 \u00b7 (tentative d'exploit)", "target_port_label": "9526 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9526, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9526, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9526 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9526\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9526 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9526" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 19:37:44 UTC	TCP	9931 · TLS	tls	Sonde TLS tls probe · via TLS:9931 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9931 Chemin / cible — Service TLS Payload �VD�S�� 5¿�41�l��6a�� v�E \7��\�j!4?V{�4��Ƴ��'��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �VD�S�� 5¿�41�l��6a�� v�E \7��\�j!4?V{�4��Ƴ��'��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �VD�S�� 5¿�41�l��6a�� v�E \7��\�j!4?V{�4��Ƴ��'��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.321899302575393, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 9931, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9c483cd5073b6c4487cd26a05200918807d29fbf", "event_fingerprint": "f1f22ccd8568f7e8197b19da16e1a1a8528259db", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "0c016f7de9d162f9489d10ffaa6b09e0", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 9931, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003VD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\u0017\ufffd v\u001d\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\u0018\ufffd\u0018\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003VD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\u0017\ufffd v\u001d\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\u0018\ufffd\u0018\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003VD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\u0017\ufffd v\u001d\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\u0018\ufffd\u0018\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e9a58e98cb62c625c9fe967300f2c7678522a308", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003VD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\u0017\ufffd v\u001d\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\u0018\ufffd\u0018\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9931, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdVD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\ufffd v\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:9931 \u00b7 (sonde \/ probe)", "target_port_label": "9931 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9931, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003VD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\u0017\ufffd v\u001d\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\u0018\ufffd\u0018\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\u001f\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9931, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:9931 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdVD\ufffdS\ufffd\ufffd\r\ufffd5\u00bf*\ufffd41\ufffdl\ufffd\ufffd6a\ufffd\ufffd v\ufffdE \\7\ufffd\ufffd\\\ufffdj!4?V{\ufffd4\ufffd\ufffd\u01b3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9931 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9931" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 19:37:44 UTC	TCP	9931 · HTTP	http	Cross-site scripting xss attack · via HTTP:9931 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9931 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9931 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9931 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f4899e33f6e7523e7b00f29f77cd39c04ac8838f", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.449590607491731, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 9931, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7186f46977e5f4b985f272d606e69a387ac7f468", "event_fingerprint": "c3d017425b52fd72c5c353df5771581386daac9e", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "14af606e36d1d7040337fc1557fbe3a2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9931, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a9dc9034333530822790b075885e0a8d8fa01032", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9931, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9931 \u00b7 (tentative d'exploit)", "target_port_label": "9931 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9931, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9931, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9931 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9931\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9931 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9931" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 19:02:36 UTC	TCP	3050 · FIREBIRD	firebird	firebird probe firebird probe · via FIREBIRD:3050 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur FIREBIRD WAF — Recommandation Surveiller Tags firebird_emulated firebird_payload net_firebird_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload ��y&�l�6^�%g�iZ�� !�m�/��s ˛q,~ˀ��Gw\��d�<��l\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « firebird_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��y&�l�6^�%g�iZ�� !�m�/��s ˛q,~ˀ��Gw\��d�<��l\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��y&�l�6^�%g�iZ�� !�m�/��s ˛q,~ˀ��Gw\��d�<��l\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 517, "payload_entropy": 4.288252074507775, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "firebird", "app_proto": "firebird", "asn": 209896, "country": "US", "dst_port": 3050, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8d10925bed6f4f7046394ad3d8e5376797005ef8", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "firebird", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "edcc0f39d299124875cd378be8b52eba", "path_pattern_hash": "6e1650c772b75626cc366734cce9c329" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\u000f\ufffdm\u000f\ufffd\u0003\/\ufffd\ufffds \t\u02dbq,~\u0005\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\u0001\ufffd\u000e\ufffd\ufffd\ufffd\u0006d\ufffd<\ufffd\ufffd\u0004\ufffd\ufffdl\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\u000f\ufffdm\u000f\ufffd\u0003\/\ufffd\ufffds \t\u02dbq,~\u0005\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\u0001\ufffd\u000e\ufffd\ufffd\ufffd\u0006d\ufffd<\ufffd\ufffd\u0004\ufffd\ufffdl\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\u000f\ufffdm\u000f\ufffd\u0003\/\ufffd\ufffds \t\u02dbq,~\u0005\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\u0001\ufffd\u000e\ufffd\ufffd\ufffd\u0006d\ufffd<\ufffd\ufffd\u0004\ufffd\ufffdl\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d7e2f094d8186d0c4743a06503e07c8fef478de6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\u000f\ufffdm\u000f\ufffd\u0003\/\ufffd\ufffds \t\u02dbq,~\u0005\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\u0001\ufffd\u000e\ufffd\ufffd\ufffd\u0006d\ufffd<\ufffd\ufffd\u0004\ufffd\ufffdl\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "\ufffd\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\ufffdm\ufffd\/\ufffd\ufffds \t\u02dbq,~\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd<\ufffd\ufffd\ufffd\ufffdl\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "firebird probe \u00b7 via FIREBIRD:3050 \u00b7 (sonde \/ probe)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via FIREBIRD", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\u000f\ufffdm\u000f\ufffd\u0003\/\ufffd\ufffds \t\u02dbq,~\u0005\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\u0001\ufffd\u000e\ufffd\ufffd\ufffd\u0006d\ufffd<\ufffd\ufffd\u0004\ufffd\ufffdl\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "firebird probe \u00b7 via FIREBIRD:3050 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdy&\ufffdl\ufffd6^\ufffd%g\ufffdiZ\ufffd\ufffd\t\ufffd\ufffd\ufffd!\ufffdm\ufffd\/\ufffd\ufffds \t\u02dbq,~\u02c0\ufffd\ufffdGw\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd<\ufffd\ufffd\ufffd\ufffdl\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "firebird_emulated", "firebird_payload", "net_firebird_probe", "tls_clienthello" ] }
07/06/2026 19:02:36 UTC	TCP	3050 · FIREBIRD	firebird	Cross-site scripting xss attack · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Surveiller Tags firebird_emulated firebird_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload GET / HTTP/1.1 Host: 62.3.50.33:3050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 399, "payload_entropy": 5.438855221777064, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "firebird", "app_proto": "firebird", "asn": 209896, "country": "US", "dst_port": 3050, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 44, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ec8e2137cff6c81f3a0b74ae669c14677c89d6ee", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 44 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1d7e2d5023c711840c0b721f731ac9b1", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "444b7ec5cc8eceec1ab383621fd16a62b7392581", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via FIREBIRD", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 44 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "xss attack \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "firebird_emulated", "firebird_payload", "http_get_probe", "mozi_pattern", "net_firebird_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 18:12:56 UTC	TCP	5451 · TLS	tls	Sonde TLS tls probe · via TLS:5451 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5451 Chemin / cible — Service TLS Payload ��.,"��a��k� �#��ìKf5<�;06O�� -�\��LPWۧ��G�I�p��=��le��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��.,"��a��k� �#��ìKf5<�;06O�� -�\��LPWۧ��G�I�p��=��le��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��.,"��a��k� �#��ìKf5<�;06O�� -�\��LPWۧ��G�I�p��=��le��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.300280765603111, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 5451, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f43cffc0c83f00fb25818a8ac4d49a8964145e16", "event_fingerprint": "108368285e4f653e719eca9166529290046e7ee6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "e075f2a8fa9c6720f3f027f40d3aa2ce", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5451, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df4a04f7d7692202a4f57a462fa4a952cd52f445", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5451, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd.,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:5451 \u00b7 (sonde \/ probe)", "target_port_label": "5451 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via TLS", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5451, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\u0010,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\u0001\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\u0013\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd\u0006=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5451, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5451 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd.,\"\ufffd\ufffda\ufffd\ufffdk\ufffd \ufffd#\ufffd\ufffd\u00ecKf5<\ufffd;06O\ufffd\ufffd -\ufffd\\\ufffd\ufffd\ufffdLPW\u06e7\ufffd\ufffdG\ufffdI\ufffdp\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffdle\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "5451 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5451" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 18:12:56 UTC	TCP	5451 · HTTP	http	Cross-site scripting xss attack · via HTTP:5451 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5451 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5451 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5451 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "6e97b0edd4363d47ee3a9e9b6061c91904cfabf7", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.449025287969969, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 5451, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b43c11f30be763a8d732067fb9b8a017090c7cd4", "event_fingerprint": "3ac1b186733d04a0e27a2a2e3f90b722a199d112", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "e06b54919781f7b7203c2e4c49d99a8b", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5451, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3718f5d188e6ce2c876a5a0da70f5b846bbd23a6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5451, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:5451 \u00b7 (tentative d'exploit)", "target_port_label": "5451 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5451, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5451, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5451 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5451\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5451 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5451" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 17:57:04 UTC	TCP	4555 · TLS	tls	Sonde TLS tls probe · via TLS:4555 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4555 Chemin / cible — Service TLS Payload ��:c:��V6ң[MӖj� Hy��$X�� 6�=,�Y��x]��h�Y�Zo�L��Hu��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��:c:��V6ң[MӖj� Hy��$X�� 6�=,�Y��x]��h�Y�Zo�L��Hu��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��:c:��V6ң[MӖj� Hy��$X�� 6�=,�Y��x]��h�Y�Zo�L��Hu��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.294382253194098, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 4555, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cad76ea2762aeb88da8fb63b00682d1ad195063e", "event_fingerprint": "d70a7fec141fbb9de9c9de0672c3a71480d3ba7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "14283f11f04da71a2b10d5b033af45e6", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 4555, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "de7f9579153c415bb28798ed3e181f1f77377bf3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 4555, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd:c:\ufffd\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\t\tHy\ufffd\ufffd$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\ufffdx]\ufffd\ufffdh\ufffdY\ufffdZo\ufffdL\ufffd\ufffdHu\ufffd\ufffda\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:4555 \u00b7 (sonde \/ probe)", "target_port_label": "4555 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via TLS", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4555, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd:c:\ufffd\b\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\u0005\t\t\u0000Hy\ufffd\ufffd\u0007$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\u0000\ufffdx]\ufffd\ufffdh\ufffd\u0019Y\ufffdZ\u0016o\ufffdL\ufffd\u0014\ufffdHu\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 4555, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:4555 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd:c:\ufffd\ufffd\ufffdV6\u04a3[M\u04d6j\ufffd\t\tHy\ufffd\ufffd$X\ufffd\ufffd\ufffd 6\ufffd=,\ufffdY\ufffd\ufffd\ufffdx]\ufffd\ufffdh\ufffdY\ufffdZo\ufffdL\ufffd\ufffdHu\ufffd\ufffda\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "4555 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4555" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 17:57:04 UTC	TCP	4555 · HTTP	http	Cross-site scripting xss attack · via HTTP:4555 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4555 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4555 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:4555 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "37c07387c0ba562ae5c517741135720a2432256a", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.44769178176536, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 4555, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1174ba79015da7e63872e88d4fdc5cddb2e289b2", "event_fingerprint": "1c4995790ea14539f12f9cbe9ada22becfa42218", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "9bdcff58b1610cea4217b3845fd60f15", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 4555, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2bad3ebb0a0b18e15bd514a5febc027c243ba5a3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4555, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:4555 \u00b7 (tentative d'exploit)", "target_port_label": "4555 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4555, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 4555, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:4555 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4555\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "4555 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4555" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 15:50:51 UTC	TCP	8522 · TLS	tls	Sonde TLS tls probe · via TLS:8522 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8522 Chemin / cible — Service TLS Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��o0��}֑3��e��16[�j��MG ޑ��?�aH,!l6K�V��ǡߎ��DU\0b+ \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��o0��}֑3��e��16[�j��MG ޑ��?�aH,!l6K�V��ǡߎ��DU\0b+ \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.313511145655005, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 8522, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "818561c348176cb3114871cf8209a5c14802cba7", "event_fingerprint": "72e1ff82bdea4b42b387a3474d92d823fda9ae69", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "f54f635378dfe06a868bc37d8aea94cd", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8522, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdo\u001b0\ufffd\ufffd\u001d}\u05913\ufffd\ufffde\ufffd\ufffd1\u001e6[\ufffdj\u0004\u0010\ufffd\ufffd\u0018\ufffd\u0001MG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\b\ufffd\u0013\ufffdDU\\0b+\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdo\u001b0\ufffd\ufffd\u001d}\u05913\ufffd\ufffde\ufffd\ufffd1\u001e6[\ufffdj\u0004\u0010\ufffd\ufffd\u0018\ufffd\u0001MG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\b\ufffd\u0013\ufffdDU\\0b+\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdo\u001b0\ufffd\ufffd\u001d}\u05913\ufffd\ufffde\ufffd\ufffd1\u001e6[\ufffdj\u0004\u0010\ufffd\ufffd\u0018\ufffd\u0001MG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\b\ufffd\u0013\ufffdDU\\0b+\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdo\u001b0\ufffd\ufffd\u001d}\u05913\ufffd\ufffde\ufffd\ufffd1\u001e6[\ufffdj\u0004\u0010\ufffd\ufffd\u0018\ufffd\u0001MG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\b\ufffd\u0013\ufffdDU\\0b+\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdo\u001b0\ufffd\ufffd\u001d}\u05913\ufffd\ufffde\ufffd\ufffd1\u001e6[\ufffdj\u0004\u0010\ufffd\ufffd\u0018\ufffd\u0001MG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\b\ufffd\u0013\ufffdDU\\0b+\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4affb6c8da62086ab64c6c1f0384531916ccedda", "protocol_details": { "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8522, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdo0\ufffd\ufffd}\u05913\ufffd\ufffde\ufffd\ufffd16[\ufffdj\ufffd\ufffd\ufffdMG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\ufffd\ufffdDU\\0b+\t\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8522 \u00b7 (sonde \/ probe)", "target_port_label": "8522 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8522, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8522, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8522 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdo0\ufffd\ufffd}\u05913\ufffd\ufffde\ufffd\ufffd16[\ufffdj\ufffd\ufffd\ufffdMG \u0791\ufffd\ufffd?\ufffdaH,!l6K\ufffdV\ufffd\ufffd\u01e1\u07ce\ufffd\ufffdDU\\0b+\t\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8522 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8522" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 15:50:51 UTC	TCP	8522 · HTTP	http	Cross-site scripting xss attack · via HTTP:8522 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8522 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8522 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8522 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "c8252d5c44b486a39b8010e142827b6fe272d2be", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.459050350626612, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 8522, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "495f378a446a8a569434a31c1c32a1f372840020", "event_fingerprint": "9d3e12ed156964b5297925eae3a21ed71131928c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "e1f2f1640af45677dfdb03001ef08685", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8522, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8cd8e90a16d98ef8c9a12809448cbc4c91faf0f9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8522, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8522 \u00b7 (tentative d'exploit)", "target_port_label": "8522 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence_pct": 59, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8522, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8522, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8522 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8522\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8522 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8522" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 15:39:58 UTC	TCP	11354 · TLS	tls	Sonde TLS tls probe · via TLS:11354 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11354 Chemin / cible — Service TLS Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �8�.��A��O��h��>�q!+�naW��24�� p��4��31yo��rGja��^j�6R�O\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �8�.��A��O��h��>�q!+�naW��24�� p��4��31yo��rGja��^j�6R�O\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.311349227908237, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "tls", "app_proto": "tls", "asn": 209896, "country": "US", "dst_port": 11354, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "2e9130b3a5224ab7db31897a1c5645ba1f2a65aa", "event_fingerprint": "0ad5d32fd2bbc75414d43b13ad44f53de7f03698", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "3ae6e631221426164d7921f3dfe889bc", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 11354, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0016\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\u001d\ufffdrGja\ufffd\u001c\ufffd^j\ufffd6R\ufffd\u0016O\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0016\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\u001d\ufffdrGja\ufffd\u001c\ufffd^j\ufffd6R\ufffd\u0016O\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0016\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\u001d\ufffdrGja\ufffd\u001c\ufffd^j\ufffd6R\ufffd\u0016O\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0016\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\u001d\ufffdrGja\ufffd\u001c\ufffd^j\ufffd6R\ufffd\u0016O\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0016\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\u001d\ufffdrGja\ufffd\u001c\ufffd^j\ufffd6R\ufffd\u0016O\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1134c5234085502a18b6fb50b698aadf58ce62e", "protocol_details": { "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 11354, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd8\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\ufffdrGja\ufffd\ufffd^j\ufffd6R\ufffdO\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:11354 \u00b7 (sonde \/ probe)", "target_port_label": "11354 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 11354, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 11354, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:11354 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd8\ufffd.\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffd\ufffdh\ufffd\ufffd>\ufffdq!+\ufffdnaW\ufffd\ufffd\ufffd24\ufffd\ufffd p\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd31yo\ufffd\ufffd\ufffd\ufffdrGja\ufffd\ufffd^j\ufffd6R\ufffdO\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "11354 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "11354" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
07/06/2026 15:39:58 UTC	TCP	11354 · HTTP	http	Cross-site scripting xss attack · via HTTP:11354 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11354 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11354 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11354 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "36db22f21abd9829711b24ef94824513456c0dc8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.449291278110535, "port_category": "registered", "org": "Contrust Solutions S.R.L.", "service": "http", "app_proto": "http", "asn": 209896, "country": "US", "dst_port": 11354, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f946f29615895b09b25517d03577632600177d26", "event_fingerprint": "a96193366b98471aad16ec74d498a5017cae4ec8", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 209896, "org": "Contrust Solutions S.R.L.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "10957c77e6f64aaedd15efcbecd5af4b", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 11354, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47ec6697e2257333bc6b2ab31d158efddfdee1d2", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 11354, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:11354 \u00b7 (tentative d'exploit)", "target_port_label": "11354 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence_pct": 59, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11354, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 11354, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:11354 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "11354 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11354" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }

77.91.118.50

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence