Renseignement sur les menaces

8.231.64.19

FAI GOOGL-2 Première vue 14/06/2026 15:01 UTC Dernière vue 14/06/2026 15:01 UTC Risque Moyen

Période analysée : 2026-03-18 → 2026-06-16

Activité suspecte — risque 62/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 63/100 Moyen

Première observation 14/06/2026 15:01 UTC

Dernière observation 14/06/2026 15:01 UTC

Événements (période) 60

MITRE ATT&CK principal TA0007 30 occurrences

Activité suspecte — risque 62/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%

Confiance 100 % — Score WAF 100 · Bonus corrélation +8 · 4 tag(s) WAF

Comparaison ASN / FAI

ASN 396982 · 8.231.64.0/18 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 60 événements sur la période pour cette IP.

34.23.82.87 web attack 04/06/2026 17:32 UTC
34.176.75.91 web attack 04/06/2026 11:54 UTC
34.77.197.231 http 31/12/2025 07:22 UTC
34.79.228.186 http 31/12/2025 07:05 UTC
34.78.37.6 http 30/12/2025 06:44 UTC
34.16.111.8 tcp 29/12/2025 10:31 UTC
34.77.172.168 http 29/12/2025 06:51 UTC
34.79.143.48 http 28/12/2025 07:19 UTC

Événements (filtres)

Première observation

14/06/2026 15:01 UTC

Dernière observation

14/06/2026 15:01 UTC

Dernière activité (filtres)

14/06/2026 15:01 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 30 TLS TCP 30

HTTP

TLS

Géolocalisation

Origine réseau déclarée

unknown unknown unknown

FAI / réseau

Opérateur et dernière activité ban

GOOGL-2 0 Port 2525 tls_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

config file probe · via HTTP:2525 · (tentative d'exploit) · → /code/.git/config

Détails protocole

Méthode: GET
Chemin: /code/.git/config
User-Agent: Mozilla/5.0 (Linux; Android 9; MI 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.42 Mob…
SMTP: Sonde protocole SMTP

Aperçu payload

GET /code/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 9; MI 8) AppleWebKit/537.36 (KHTM

Port / service

2525 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF

Technique MITRE

T1083

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

SIGMA-web-config-leak Http Sensitive Upstream Waf Score

Confiance

100% Corrélation +8

Famille de menace

path_traversal config_leak_scan

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

60 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

60 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��>�n�wP�Kz�� 6��E-k� HҾȟ��+-FQS˵N}?��'��h^�,��@&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��>�n�wP�Kz�� 6��E-k� HҾȟ��+-FQS˵N}?��'��h^�,��@&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��>�n�wP�Kz�� 6��E-k� HҾȟ��+-FQS˵N}?��'��h^�,��@&�+�/�,�0̨̩� �� /5� w �+3&$ ��zD�Z�ƱDr$m�lAv�h��":EM Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.823157128462448, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "36191d1fb7e158957ecd113ea204c57e", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0001\ufffdn\ufffdwP\ufffd\u0015Kz\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-\u001ak\u0000\ufffd H\u04be\u021f\ufffd\ufffd\u001a+-FQS\u02f5N}?\ufffd\u0018\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd\u0002@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0001\ufffdn\ufffdwP\ufffd\u0015Kz\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-\u001ak\u0000\ufffd H\u04be\u021f\ufffd\ufffd\u001a+-FQS\u02f5N}?\ufffd\u0018\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd\u0002@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0014\ufffdzD\ufffdZ\ufffd\u01b1Dr$\u0015m\u0005\ufffdlAv\ufffd\u001ch\ufffd\ufffd\ufffd\":\u0013EM", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0001\ufffdn\ufffdwP\ufffd\u0015Kz\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-\u001ak\u0000\ufffd H\u04be\u021f\ufffd\ufffd\u001a+-FQS\u02f5N}?\ufffd\u0018\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd\u0002@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3dc9b77b7774ce87cfbaecda82c616834a4c8a6", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0001\ufffdn\ufffdwP\ufffd\u0015Kz\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-\u001ak\u0000\ufffd H\u04be\u021f\ufffd\ufffd\u001a+-FQS\u02f5N}?\ufffd\u0018\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd\u0002@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd>\ufffdn\ufffdwP\ufffdKz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-k\ufffd H\u04be\u021f\ufffd\ufffd+-FQS\u02f5N}?\ufffd\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd@&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0001\ufffdn\ufffdwP\ufffd\u0015Kz\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-\u001ak\u0000\ufffd H\u04be\u021f\ufffd\ufffd\u001a+-FQS\u02f5N}?\ufffd\u0018\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd\u0002@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd>\ufffdn\ufffdwP\ufffdKz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffd\ufffdE-k\ufffd H\u04be\u021f\ufffd\ufffd+-FQS\u02f5N}?\ufffd\ufffd'\ufffd\ufffdh^\ufffd,\ufffd\ufffd@&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��<vN��w��f��/��[H��)/ ��q��%Bc��\��[�@��X(��/B��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��<vN��w��f��/��[H��)/ ��q��%Bc��\��[�@��X(��/B��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��<vN��w��f��/��[H��)/ ��q��%Bc��\��[�@��X(��/B��&�+�/�,�0̨̩� �� /5� w �+3&$ �� -`��̻`�%��Ӆ葨�?O��' Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.880163979428579, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "1b2edee80402c6e3c08a7deb2bf489ca", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd<vN\ufffd\ufffd\u0010\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffd\u001fX\u0011(\ufffd\ufffd\/B\ufffd\ufffd\u000e\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd<vN\ufffd\ufffd\u0010\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffd\u001fX\u0011(\ufffd\ufffd\/B\ufffd\ufffd\u000e\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\r-`\ufffd\ufffd\u033b`\ufffd%\ufffd\ufffd\ufffd\u0002\u04c5\u8468\ufffd\u0011?O\ufffd\ufffd'\u0002", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd<vN\ufffd\ufffd\u0010\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffd\u001fX\u0011(\ufffd\ufffd\/B\ufffd\ufffd\u000e\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "339275a0a6c570d6a10ca8433dbea1954bcbd28e", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd<vN\ufffd\ufffd\u0010\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffd\u001fX\u0011(\ufffd\ufffd\/B\ufffd\ufffd\u000e\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd<vN\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffdX(\ufffd\ufffd\/B\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd<vN\ufffd\ufffd\u0010\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffd\u001fX\u0011(\ufffd\ufffd\/B\ufffd\ufffd\u000e\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd<vN\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd[H\ufffd\ufffd)\/ \ufffd\ufffdq\ufffd\ufffd%Bc\ufffd\ufffd\\\ufffd\ufffd[\ufffd@\ufffd\ufffd\ufffdX(\ufffd\ufffd\/B\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��t�]��fbW��x>��&�D5�g�>n�X~ �d�� Ժ�1�;;˜��!�Z��E{�+��h &�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��t�]��fbW��x>��&�D5�g�>n�X~ �d�� Ժ�1�;;˜��!�Z��E{�+��h &�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��t�]��fbW��x>��&�D5�g�>n�X~ �d�� Ժ�1�;;˜��!�Z��E{�+��h &�+�/�,�0̨̩� �� /5� w �+3&$ �52�U�G�W�A��,�d��Pi�^ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.76267820598243, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "a009eb92237a2f25c22da1dfc6fccb0e", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018t\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\u0000\ufffd\ufffd\u0013\ufffd&\ufffdD5\ufffdg\ufffd>\u001an\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\u0000\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018t\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\u0000\ufffd\ufffd\u0013\ufffd&\ufffdD5\ufffdg\ufffd>\u001an\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\u0000\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0007 \ufffd52\ufffdU\ufffdG\ufffd\u0014W\ufffd\u000e\u0005A\ufffd\ufffd\u0017,\ufffdd\u0004\u0014\ufffd\ufffdPi\ufffd^\u001f", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018t\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\u0000\ufffd\ufffd\u0013\ufffd&\ufffdD5\ufffdg\ufffd>\u001an\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\u0000\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "375b84f784bbbd4f7f3b7ba4ea8b7292cd3c08c7", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018t\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\u0000\ufffd\ufffd\u0013\ufffd&\ufffdD5\ufffdg\ufffd>\u001an\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\u0000\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdt\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\ufffd\ufffd\ufffd&\ufffdD5\ufffdg\ufffd>n\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018t\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\u0000\ufffd\ufffd\u0013\ufffd&\ufffdD5\ufffdg\ufffd>\u001an\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\u0000\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdt\ufffd]\ufffd\ufffdfbW\ufffd\ufffdx>\ufffd\ufffd\ufffd&\ufffdD5\ufffdg\ufffd>n\ufffdX~ \ufffdd\ufffd\ufffd \ufffd\u053a\ufffd1\ufffd;;\u02dc\ufffd\ufffd!\ufffdZ\ufffd\ufffdE{\ufffd+\ufffd\ufffdh\n&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��޺� ďvR�k�թp5�y�n0�R[��?�F N~�+Z�Wf��)�Z4��Gَ��NO�j&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��޺� ďvR�k�թp5�y�n0�R[��?�F N~�+Z�Wf��)�Z4��Gَ��NO�j&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��޺� ďvR�k�թp5�y�n0�R[��?�F N~�+Z�Wf��)�Z4��Gَ��NO�j&�+�/�,�0̨̩� �� /5� w �+3&$ ��8��t��n�sf��L�H��a Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.885048131805357, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "19f6178b422681fa10dbeccf7888159a", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffd\u000fy\ufffdn\u00030\u000e\ufffdR[\ufffd\ufffd?\ufffd\u0004F N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u0012\u064e\ufffd\ufffd\ufffdNO\u0001\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffd\u000fy\ufffdn\u00030\u000e\ufffdR[\ufffd\ufffd?\ufffd\u0004F N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u0012\u064e\ufffd\ufffd\ufffdNO\u0001\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\u0019t\ufffd\ufffd\ufffdn\ufffdsf\ufffd\ufffd\ufffdL\ufffdH\u0012\ufffd\ufffd\ufffda", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffd\u000fy\ufffdn\u00030\u000e\ufffdR[\ufffd\ufffd?\ufffd\u0004F N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u0012\u064e\ufffd\ufffd\ufffdNO\u0001\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "29127c3fcb612019672193c5cefb8f96c1ef644d", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffd\u000fy\ufffdn\u00030\u000e\ufffdR[\ufffd\ufffd?\ufffd\u0004F N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u0012\u064e\ufffd\ufffd\ufffdNO\u0001\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffdy\ufffdn0\ufffdR[\ufffd\ufffd?\ufffdF N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u064e\ufffd\ufffd\ufffdNO\ufffdj&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffd\u000fy\ufffdn\u00030\u000e\ufffdR[\ufffd\ufffd?\ufffd\u0004F N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u0012\u064e\ufffd\ufffd\ufffdNO\u0001\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07ba\ufffd \u010fvR\ufffdk\ufffd\u0569p5\ufffdy\ufffdn0\ufffdR[\ufffd\ufffd?\ufffdF N~\ufffd+Z\ufffdWf\ufffd\ufffd\ufffd)\ufffdZ4\ufffd\ufffd\ufffdG\u064e\ufffd\ufffd\ufffdNO\ufffdj&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��׺��.pi�/tr�h:�� { �e� \|HZ�� Φ9H{,w�6?>dH�L�c��2�7AE&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��׺��.pi�/tr�h:��{�e� \|HZ��Φ9H{,w�6?>dH�L�c��2�7AE&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��׺��.pi�/tr�h:�� { �e� \|HZ�� Φ9H{,w�6?>dH�L�c��2�7AE&�+�/�,�0̨̩� �� /5� w �+3&$ �P_4�銴�2�T��+�B��I��R�ev Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.799352051452907, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "06b1044296dd115b64d141c8590b0bcb", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001a\ufffd\u05fa\ufffd\ufffd\u0000\u0004\ufffd\ufffd.\u001dpi\u0013\ufffd\/tr\ufffdh\u001e:\ufffd\ufffd\u000b{\u000b\ufffde\ufffd \|HZ\ufffd\ufffd\u000b\u03a69H{,w\ufffd6?>d\u0019H\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001a\ufffd\u05fa\ufffd\ufffd\u0000\u0004\ufffd\ufffd.\u001dpi\u0013\ufffd\/tr\ufffdh\u001e:\ufffd\ufffd\u000b{\u000b\ufffde\ufffd \|HZ\ufffd\ufffd\u000b\u03a69H{,w\ufffd6?>d\u0019H\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdP_4\u0001\ufffd\u92b4\ufffd2\ufffdT\ufffd\ufffd+\ufffd\u0011B\ufffd\ufffd\bI\u0000\ufffd\ufffdR\ufffde\u0011v\u0018", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001a\ufffd\u05fa\ufffd\ufffd\u0000\u0004\ufffd\ufffd.\u001dpi\u0013\ufffd\/tr\ufffdh\u001e:\ufffd\ufffd\u000b{\u000b\ufffde\ufffd \|HZ\ufffd\ufffd\u000b\u03a69H{,w\ufffd6?>d\u0019H\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "92a47b17d870dd779397273f7d15f97b8cdcc5d2", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001a\ufffd\u05fa\ufffd\ufffd\u0000\u0004\ufffd\ufffd.\u001dpi\u0013\ufffd\/tr\ufffdh\u001e:\ufffd\ufffd\u000b{\u000b\ufffde\ufffd \|HZ\ufffd\ufffd\u000b\u03a69H{,w\ufffd6?>d\u0019H\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u05fa\ufffd\ufffd\ufffd\ufffd.pi\ufffd\/tr\ufffdh:\ufffd\ufffd{\ufffde\ufffd \|HZ\ufffd\ufffd\u03a69H{,w\ufffd6?>dH\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001a\ufffd\u05fa\ufffd\ufffd\u0000\u0004\ufffd\ufffd.\u001dpi\u0013\ufffd\/tr\ufffdh\u001e:\ufffd\ufffd\u000b{\u000b\ufffde\ufffd \|HZ\ufffd\ufffd\u000b\u03a69H{,w\ufffd6?>d\u0019H\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u05fa\ufffd\ufffd\ufffd\ufffd.pi\ufffd\/tr\ufffdh:\ufffd\ufffd{\ufffde\ufffd \|HZ\ufffd\ufffd\u03a69H{,w\ufffd6?>dH\ufffdL\ufffdc\ufffd\ufffd2\ufffd7AE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��h-G��9ÿ�B�\�t~�D��=h�@�bC��D! �Y;�e��9�p4_9RPC�JU��s9��Gu��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��h-G��9ÿ�B�\�t~�D��=h�@�bC��D! �Y;�e��9�p4_9RPC�JU��s9��Gu��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��h-G��9ÿ�B�\�t~�D��=h�@�bC��D! �Y;�e��9�p4_9RPC�JU��s9��Gu��&�+�/�,�0̨̩� �� /5� w �+3&$ �FmҾ��m �J��ǕD�T5l1�H Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.872352743536082, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "465b376b237832b4fe7b153d55e7806e", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\u0017\ufffd\u00079\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\u0017\ufffd\u00079\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdFm\u04be\u0010\u0001\ufffd\u0016\ufffdm\u000b\ufffdJ\ufffd\ufffd\ufffd\u01d5\u0004D\ufffdT5\u0014l\u00151\u0016\ufffdH\u0014", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\u0017\ufffd\u00079\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f0fd600b7dca8e18f690b1a1d07289943f33b267", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\u0017\ufffd\u00079\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdh-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\ufffd9\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\u0017\ufffd\u00079\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdh-G\ufffd\ufffd9\u00ff\ufffdB\ufffd\\\ufffdt~\ufffdD\ufffd\ufffd=h\ufffd@\ufffdbC\ufffd\ufffdD! \ufffdY;\ufffde\ufffd\ufffd9\ufffdp4_9RPC\ufffdJU\ufffd\ufffds9\ufffd\ufffdGu\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��Ű�w诿�Э�6Z�� s�a�% �E�>5�m��;m��wM�~�M��]�ON��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Ű�w诿�Э�6Z�� s�a�% �E�>5�m��;m��wM�~�M��]�ON��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��Ű�w诿�Э�6Z�� s�a�% �E�>5�m��;m��wM�~�M��]�ON��&�+�/�,�0̨̩� �� /5� w �+3&$ ��ύ2�Ώ>��rcG�4@ S a<5�� Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.858011758709463, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "2d13e3fb52e3ae7bc626065f5e922666", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u0003\u042d\ufffd6\u001b\u0003Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\u0004\ufffd]\ufffdON\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u0003\u042d\ufffd6\u001b\u0003Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\u0004\ufffd]\ufffdON\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\u03cd2\ufffd\u038f>\ufffd\u0000\ufffd\ufffd\ufffdrcG\ufffd4@\u000bS\ta\u0011<5\u001c\ufffd\ufffd\u000f", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u0003\u042d\ufffd6\u001b\u0003Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\u0004\ufffd]\ufffdON\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a11c8335e4ac800586093909f9cfa132e3ac8a12", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u0003\u042d\ufffd6\u001b\u0003Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\u0004\ufffd]\ufffdON\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u042d\ufffd6Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\ufffd]\ufffdON\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u0003\u042d\ufffd6\u001b\u0003Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\u0004\ufffd]\ufffdON\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0170\ufffdw\u8bff\ufffd\u042d\ufffd6Z\ufffd\ufffd\n\ufffd\ufffd\ufffds\ufffda\ufffd% \ufffdE\ufffd>5\ufffdm\ufffd\ufffd;m\ufffd\ufffd\ufffdwM\ufffd~\ufffdM\ufffd\ufffd\ufffd]\ufffdON\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��i�#�55y��7H��ǫ뺮x�ƺw�� j2ݫ��^�Xr�^�5�F��T�?T@�{f`JE&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��i�#�55y��7H��ǫ뺮x�ƺw�� j2ݫ��^�Xr�^�5�F��T�?T@�{f`JE&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��i�#�55y��7H��ǫ뺮x�ƺw�� j2ݫ��^�Xr�^�5�F��T�?T@�{f`JE&�+�/�,�0̨̩� �� /5� w �+3&$ V KJ&�q�2�S��ŇJ�0�_ZL�\|hg:�eY<> Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.892998485486906, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "6bb02b9d6a5072d267429b53950848be", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\u0003\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd\u0001{f`J\u0012E\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\u0003\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd\u0001{f`J\u0012E\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 V\rKJ&\ufffdq\ufffd2\ufffdS\ufffd\ufffd\u0147J\ufffd0\ufffd_ZL\ufffd\|hg:\ufffdeY<>", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\u0003\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd\u0001{f`J\u0012E\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60ff791fe127d810d774404a29303641350f7711", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\u0003\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd\u0001{f`J\u0012E\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdi\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd{f`JE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\u0003\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd\u0001{f`J\u0012E\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdi\ufffd#\ufffd55y\ufffd\ufffd\ufffd7H\ufffd\ufffd\ufffd\ufffd\u01eb\ubeaex\ufffd\u01baw\ufffd\ufffd j2\u076b\ufffd\ufffd^\ufffdXr\ufffd^\ufffd5\ufffdF\ufffd\ufffd\ufffdT\ufffd?T@\ufffd{f`JE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��r�n�ǃܔ!�u��}ka� ��`{�J' �"c�R�Y+� �'o�� ބ�^D��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��r�n�ǃܔ!�u��}ka� ��`{�J' �"c�R�Y+��'o�� ބ�^D��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��r�n�ǃܔ!�u��}ka� ��`{�J' �"c�R�Y+� �'o�� ބ�^D��&�+�/�,�0̨̩� �� /5� w �+3&$ ��FBSK��V�-$O�i��n�'�CY� Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.812064204249706, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "c51838d5577c14ec14650dee46fc2bd7", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffd\u0018u\ufffd\ufffd}ka\u0017\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffd\u0002J' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\u000b\ufffd'o\ufffd\ufffd\u0006\n\ufffd\ufffd\ufffd\ufffd\u001d\u0784\ufffd^D\u0003\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffd\u0018u\ufffd\ufffd}ka\u0017\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffd\u0002J' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\u000b\ufffd'o\ufffd\ufffd\u0006\n\ufffd\ufffd\ufffd\ufffd\u001d\u0784\ufffd^D\u0003\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdFBSK\ufffd\ufffd\u0014\u0011\ufffd\ufffdV\ufffd-$O\ufffdi\ufffd\ufffd\u0004\bn\ufffd'\ufffdCY\ufffd\u0002", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffd\u0018u\ufffd\ufffd}ka\u0017\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffd\u0002J' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\u000b\ufffd'o\ufffd\ufffd\u0006\n\ufffd\ufffd\ufffd\ufffd\u001d\u0784\ufffd^D\u0003\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5450c03ae496a4150e4a9aa6fd1b3d93ba714014", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffd\u0018u\ufffd\ufffd}ka\u0017\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffd\u0002J' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\u000b\ufffd'o\ufffd\ufffd\u0006\n\ufffd\ufffd\ufffd\ufffd\u001d\u0784\ufffd^D\u0003\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffdu\ufffd\ufffd}ka\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffdJ' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\ufffd'o\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\u0784\ufffd^D\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffd\u0018u\ufffd\ufffd}ka\u0017\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffd\u0002J' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\u000b\ufffd'o\ufffd\ufffd\u0006\n\ufffd\ufffd\ufffd\ufffd\u001d\u0784\ufffd^D\u0003\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdn\ufffd\u01c3\u0714!\ufffdu\ufffd\ufffd}ka\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd`{\ufffdJ' \t\ufffd\"c\ufffdR\ufffdY+\ufffd\ufffd'o\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\u0784\ufffd^D\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��̴�iJb��GZ��~7��Jx��qW�j ��3�Y�S�O;s��0G@&�vl�;Ȍ}rT�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��̴�iJb��GZ��~7��Jx��qW�j ��3�Y�S�O;s��0G@&�vl�;Ȍ}rT�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��̴�iJb��GZ��~7��Jx��qW�j ��3�Y�S�O;s��0G@&�vl�;Ȍ}rT�&�+�/�,�0̨̩� �� /5� w �+3&$ �e��Y�E)ܥa�}�m��%�,5#{�f Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.906375956443188, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "474e0c9d9e12d803a32fcabece64d0bb", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\u001f\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;\u001bs\ufffd\ufffd\u000f\u00160G@&\ufffdvl\ufffd;\u020c}r\u000fT\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\u001f\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;\u001bs\ufffd\ufffd\u000f\u00160G@&\ufffdvl\ufffd;\u020c}r\u000fT\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffde\ufffd\ufffd\ufffd\ufffdY\ufffd\u0006E\u0018)\u0725a\ufffd}\ufffdm\ufffd\ufffd%\u0013\ufffd,5#{\ufffd\u001af", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\u001f\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;\u001bs\ufffd\ufffd\u000f\u00160G@&\ufffdvl\ufffd;\u020c}r\u000fT\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f221728fab8ae4d0e56201fcdb5779225c097815", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\u001f\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;\u001bs\ufffd\ufffd\u000f\u00160G@&\ufffdvl\ufffd;\u020c}r\u000fT\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;s\ufffd\ufffd0G@&\ufffdvl\ufffd;\u020c}rT\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\u001f\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;\u001bs\ufffd\ufffd\u000f\u00160G@&\ufffdvl\ufffd;\u020c}r\u000fT\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u0334\ufffdiJb\ufffd\ufffdGZ\ufffd\ufffd~7\ufffd\ufffd\ufffdJx\ufffd\ufffd\ufffd\ufffd\ufffdqW\ufffdj \ufffd\ufffd3\ufffdY\ufffdS\ufffdO;s\ufffd\ufffd0G@&\ufffdvl\ufffd;\u020c}rT\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��A��^�B��;�o'��С��`L8�� q��t��#�5��a �� &�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��A��^�B��;�o'��С��`L8�� q��t��#�5��a �� &�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��A��^�B��;�o'��С��`L8�� q��t��#�5��a �� &�+�/�,�0̨̩� �� /5� w �+3&$ '�3X�+�8��T�֍��\|Fr7�H��R4 Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.794228144154118, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "58c9eb2472bb291affcdc50c3e1c486e", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0016A\u001a\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\u001b\ufffd\ufffd\u0421\ufffd\u0016\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\u0002\ufffd\ufffd\u001a\ufffd\u0000\ufffd\ufffd\ufffd\ufffd#\ufffd\u00045\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0016A\u001a\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\u001b\ufffd\ufffd\u0421\ufffd\u0016\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\u0002\ufffd\ufffd\u001a\ufffd\u0000\ufffd\ufffd\ufffd\ufffd#\ufffd\u00045\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 '\ufffd3X\ufffd+\u0000\ufffd8\ufffd\ufffdT\ufffd\u058d\ufffd\ufffd\ufffd\|F\u0003r7\ufffdH\ufffd\ufffd\ufffdR4", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0016A\u001a\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\u001b\ufffd\ufffd\u0421\ufffd\u0016\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\u0002\ufffd\ufffd\u001a\ufffd\u0000\ufffd\ufffd\ufffd\ufffd#\ufffd\u00045\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1693a41905d35cc6c492d5476e67f036ec216430", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0016A\u001a\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\u001b\ufffd\ufffd\u0421\ufffd\u0016\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\u0002\ufffd\ufffd\u001a\ufffd\u0000\ufffd\ufffd\ufffd\ufffd#\ufffd\u00045\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\ufffd\ufffd\u0421\ufffd\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0016A\u001a\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\u001b\ufffd\ufffd\u0421\ufffd\u0016\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\u0002\ufffd\ufffd\u001a\ufffd\u0000\ufffd\ufffd\ufffd\ufffd#\ufffd\u00045\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd^\ufffdB\ufffd\ufffd\ufffd;\ufffdo'\ufffd\ufffd\ufffd\u0421\ufffd\ufffd`L8\ufffd\ufffd q\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\t\ufffd\ufffd\t\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��r�%�ڴ�R��b��J�d�f b�] I� �U��ĸ+��tx��P��UI$�j�~&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��r�%�ڴ�R��b��J�d�fb�] I� �U��ĸ+��tx��P��UI$�j�~&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��r�%�ڴ�R��b��J�d�f b�] I� �U��ĸ+��tx��P��UI$�j�~&�+�/�,�0̨̩� �� /5� w �+3&$ WڸLr�w#�Ct�X0��he[�3�� ^ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.833603266846376, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "d123f3c5e8e5ebac301363b7a22fdef1", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffd\u0013\u0007%\ufffd\u06b4\u0018\u0001\ufffdR\ufffd\ufffd\u001e\u000f\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdf\u000bb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\u0015\ufffd\u0013\u000e\ufffdU\u001fI$\ufffdj\ufffd~\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffd\u0013\u0007%\ufffd\u06b4\u0018\u0001\ufffdR\ufffd\ufffd\u001e\u000f\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdf\u000bb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\u0015\ufffd\u0013\u000e\ufffdU\u001fI$\ufffdj\ufffd~\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 W\u0005\u06b8Lr\ufffdw#\ufffdCt\ufffdX0\ufffd\u001d\ufffd\ufffdhe[\ufffd3\u0014\ufffd\ufffd\r^", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffd\u0013\u0007%\ufffd\u06b4\u0018\u0001\ufffdR\ufffd\ufffd\u001e\u000f\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdf\u000bb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\u0015\ufffd\u0013\u000e\ufffdU\u001fI$\ufffdj\ufffd~\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "13266450c9c5c8fe356d0af509811c327b413872", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffd\u0013\u0007%\ufffd\u06b4\u0018\u0001\ufffdR\ufffd\ufffd\u001e\u000f\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdf\u000bb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\u0015\ufffd\u0013\u000e\ufffdU\u001fI$\ufffdj\ufffd~\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdr\ufffd%\ufffd\u06b4\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdfb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\ufffd\ufffdUI$\ufffdj\ufffd~&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffd\u0013\u0007%\ufffd\u06b4\u0018\u0001\ufffdR\ufffd\ufffd\u001e\u000f\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdf\u000bb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\u0015\ufffd\u0013\u000e\ufffdU\u001fI$\ufffdj\ufffd~\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdr\ufffd%\ufffd\u06b4\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffdJ\ufffdd\ufffdfb\ufffd] I\ufffd\r\ufffdU\ufffd\ufffd\u0138+\ufffd\ufffdtx\ufffd\ufffd\ufffdP\ufffd\ufffdUI$\ufffdj\ufffd~&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��H9 (��i��i'V$;�=�B#��< �� 4 ��Vah��#&��mP嬟�q?gJ(_&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��H9 (��i��i'V$;�=�B#��< �� 4 ��Vah��#&��mP嬟�q?gJ(_&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��H9 (��i��i'V$;�=�B#��< �� 4 ��Vah��#&��mP嬟�q?gJ(_&�+�/�,�0̨̩� �� /5� w �+3&$ ԣ��l j#�b#��?�z3�ˉ @x/ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.746502774803417, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "7b70fdaede621e29ff800846fd3b9585", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH9 (\ufffd\ufffdi\u0013\ufffd\ufffd\ufffd\ufffdi'V$\u001b;\b\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\u0007\ufffd\ufffdVah\ufffd\u0001\u0015\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH9 (\ufffd\ufffdi\u0013\ufffd\ufffd\ufffd\ufffdi'V$\u001b;\b\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\u0007\ufffd\ufffdVah\ufffd\u0001\u0015\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0018\u0001\u0523\ufffd\ufffd\u0013\ufffd\u0003\ufffdl\nj#\ufffdb#\ufffd\ufffd?\ufffdz3\ufffd\u02c9\r@\u0003x\/", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH9 (\ufffd\ufffdi\u0013\ufffd\ufffd\ufffd\ufffdi'V$\u001b;\b\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\u0007\ufffd\ufffdVah\ufffd\u0001\u0015\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "660b6679b77088a8d76bd6e8341b18ff9963228b", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH9 (\ufffd\ufffdi\u0013\ufffd\ufffd\ufffd\ufffdi'V$\u001b;\b\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\u0007\ufffd\ufffdVah\ufffd\u0001\u0015\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdH9 (\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdi'V$;\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\ufffd\ufffdVah\ufffd\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH9 (\ufffd\ufffdi\u0013\ufffd\ufffd\ufffd\ufffdi'V$\u001b;\b\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\u0007\ufffd\ufffdVah\ufffd\u0001\u0015\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdH9 (\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdi'V$;\ufffd=\ufffdB#\ufffd\ufffd\ufffd<\t\ufffd\ufffd 4\t\ufffd\ufffd\ufffd\ufffd\ufffdVah\ufffd\ufffd#&\ufffd\ufffdmP\u5b1f\ufffdq?gJ(_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��F��{�5�ִӿn��P�'�'xYr��lۀ�� r�"�ڀ��)Mۍg�h��vF��f(��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��F��{�5�ִӿn��P�'�'xYr��lۀ�� r�"�ڀ��)Mۍg�h��vF��f(��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��F��{�5�ִӿn��P�'�'xYr��lۀ�� r�"�ڀ��)Mۍg�h��vF��f(��&�+�/�,�0̨̩� �� /5� w �+3&$ U�dm��;\�L��/~2e�E+"�\|��+ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.838159194059644, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "0782e992305e5d2060ab48197224f3e4", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\ufffd\ufffd{\u0017\ufffd\u000f5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xY\u0004r\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\u0000\ufffd\u0680\ufffd\ufffd\ufffd\u000f)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\u001d\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\ufffd\ufffd{\u0017\ufffd\u000f5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xY\u0004r\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\u0000\ufffd\u0680\ufffd\ufffd\ufffd\u000f)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\u001d\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \bU\ufffddm\b\ufffd\ufffd\ufffd;\\\ufffdL\ufffd\ufffd\u001a\/~\u00152e\ufffdE+\"\ufffd\u0002\|\ufffd\ufffd+", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\ufffd\ufffd{\u0017\ufffd\u000f5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xY\u0004r\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\u0000\ufffd\u0680\ufffd\ufffd\ufffd\u000f)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\u001d\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf4c18d13552ed26ce582bb59e8dc531617172b4", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\ufffd\ufffd{\u0017\ufffd\u000f5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xY\u0004r\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\u0000\ufffd\u0680\ufffd\ufffd\ufffd\u000f)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\u001d\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdF\ufffd\ufffd{\ufffd5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xYr\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\ufffd\u0680\ufffd\ufffd\ufffd)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\ufffd\ufffd{\u0017\ufffd\u000f5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xY\u0004r\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\u0000\ufffd\u0680\ufffd\ufffd\ufffd\u000f)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\u001d\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdF\ufffd\ufffd{\ufffd5\ufffd\u05b4\u04ffn\ufffd\ufffdP\ufffd'\ufffd'xYr\ufffd\ufffdl\u06c0\ufffd\ufffd r\ufffd\"\ufffd\u0680\ufffd\ufffd\ufffd)M\u06cdg\ufffdh\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffdf(\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��0_�m�� 5��E��F� a�>o�� 2清�Dd�Cꕚ��a��7,�a�f8`�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��0_�m�� 5��E��F� a�>o�� 2清�Dd�Cꕚ��a��7,�a�f8`�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��0_�m�� 5��E��F� a�>o�� 2清�Dd�Cꕚ��a��7,�a�f8`�&�+�/�,�0̨̩� �� /5� w �+3&$ ]��!�X�Z�?��w�3r�Mg�z{�Y�e Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.77757357800518, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "f5744353b28cf606a091cde72b77a7b6", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030_\ufffdm\ufffd\ufffd\ufffd\r\u001a5\ufffd\u0003\ufffdE\u0019\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\u001d\ufffd\u0010\u0006C\ua55a\ufffd\ufffd\ufffd\u0004a\ufffd\ufffd7,\ufffda\ufffdf8\u0002`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030_\ufffdm\ufffd\ufffd\ufffd\r\u001a5\ufffd\u0003\ufffdE\u0019\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\u001d\ufffd\u0010\u0006C\ua55a\ufffd\ufffd\ufffd\u0004a\ufffd\ufffd7,\ufffda\ufffdf8\u0002`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ]\ufffd\ufffd!\ufffd\u0015X\ufffdZ\ufffd?\ufffd\ufffd\ufffdw\ufffd3r\u0007\ufffdMg\ufffdz{\u0003\ufffd\u0011Y\ufffd\u0004e", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030_\ufffdm\ufffd\ufffd\ufffd\r\u001a5\ufffd\u0003\ufffdE\u0019\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\u001d\ufffd\u0010\u0006C\ua55a\ufffd\ufffd\ufffd\u0004a\ufffd\ufffd7,\ufffda\ufffdf8\u0002`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8e4e0fd794809bf28df025dbd2ce9d3a3d1e4b61", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030_\ufffdm\ufffd\ufffd\ufffd\r\u001a5\ufffd\u0003\ufffdE\u0019\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\u001d\ufffd\u0010\u0006C\ua55a\ufffd\ufffd\ufffd\u0004a\ufffd\ufffd7,\ufffda\ufffdf8\u0002`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd0_\ufffdm\ufffd\ufffd\ufffd\r5\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\ufffdC\ua55a\ufffd\ufffd\ufffda\ufffd\ufffd7,\ufffda\ufffdf8`\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030_\ufffdm\ufffd\ufffd\ufffd\r\u001a5\ufffd\u0003\ufffdE\u0019\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\u001d\ufffd\u0010\u0006C\ua55a\ufffd\ufffd\ufffd\u0004a\ufffd\ufffd7,\ufffda\ufffdf8\u0002`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd0_\ufffdm\ufffd\ufffd\ufffd\r5\ufffd\ufffdE*\ufffd\ufffd\ufffd\ufffdF\ufffd\ta\ufffd>o\ufffd\ufffd\ufffd\ufffd\ufffd 2\u6e05\ufffdDd\ufffdC\ua55a\ufffd\ufffd\ufffda\ufffd\ufffd7,\ufffda\ufffdf8`\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��Zα��IWT��cl�7�� _��"��= ��h�uW}P�=#��~�e�+��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Zα��IWT��cl�7�� _��"��= ��h�uW}P�=#��~�e�+��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��Zα��IWT��cl�7�� _��"��= ��h�uW}P�=#��~�e�+��&�+�/�,�0̨̩� �� /5� w �+3&$ �l�u�9��$3CZ#\|ui��#ٷr?� Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.787017693948666, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "a530da9ec992633263b054866279b8b6", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\u0013Z\u001a\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t\u0015_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0012= \ufffd\u001d\ufffdh\u0011\u0011\ufffdu\u0000W}P\u0014\u0002\ufffd=\u000f#\u001d\ufffd\ufffd\ufffd~\b\ufffde\u0004\ufffd+\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\u0013Z\u001a\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t\u0015_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0012= \ufffd\u001d\ufffdh\u0011\u0011\ufffdu\u0000W}P\u0014\u0002\ufffd=\u000f#\u001d\ufffd\ufffd\ufffd~\b\ufffde\u0004\ufffd+\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000f\ufffdl\ufffdu\ufffd9\ufffd\ufffd\ufffd\ufffd$3CZ#\|ui\ufffd\ufffd\ufffd\ufffd#\u0677r?\ufffd\u001b", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\u0013Z\u001a\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t\u0015_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0012= \ufffd\u001d\ufffdh\u0011\u0011\ufffdu\u0000W}P\u0014\u0002\ufffd=\u000f#\u001d\ufffd\ufffd\ufffd~\b\ufffde\u0004\ufffd+\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6e8ffbee84b3916406e231644bde694fa9410d86", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\u0013Z\u001a\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t\u0015_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0012= \ufffd\u001d\ufffdh\u0011\u0011\ufffdu\u0000W}P\u0014\u0002\ufffd=\u000f#\u001d\ufffd\ufffd\ufffd~\b\ufffde\u0004\ufffd+\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdZ\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd= \ufffd\ufffdh\ufffduW}P\ufffd=#\ufffd\ufffd\ufffd~\ufffde\ufffd+\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\u0013Z\u001a\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t\u0015_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0012= \ufffd\u001d\ufffdh\u0011\u0011\ufffdu\u0000W}P\u0014\u0002\ufffd=\u000f#\u001d\ufffd\ufffd\ufffd~\b\ufffde\u0004\ufffd+\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdZ\u03b1\ufffd\ufffdIWT\ufffd\ufffdcl\ufffd7\ufffd\ufffd\t_\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd= \ufffd\ufffdh\ufffduW}P\ufffd=#\ufffd\ufffd\ufffd~\ufffde\ufffd+\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��@��r��{�� R"��x�� 5�u ��E��2��q��:�=�[1,�3��uCZ&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��@��r��{�� R"��x��5�u ��E��2��q��:�=�[1,�3��uCZ&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��@��r��{�� R"��x�� 5�u ��E��2��q��:�=�[1,�3��uCZ&�+�/�,�0̨̩� �� /5� w �+3&$ �0�ߧ��k^u��W$�-��#�h� Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.7519928841471035, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "c8f28083257ddc424720dc107401cea3", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffd\ufffdr\ufffd\ufffd\u0013{\ufffd\ufffd\r\ufffd\ufffd\ufffd\bR\"\ufffd\ufffd\ufffd\u0019\ufffdx\ufffd\ufffd\f\ufffd5\ufffdu \ufffd\ufffd\u0000\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd\u0000[1,\ufffd\u00053\ufffd\ufffduCZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffd\ufffdr\ufffd\ufffd\u0013{\ufffd\ufffd\r\ufffd\ufffd\ufffd\bR\"\ufffd\ufffd\ufffd\u0019\ufffdx\ufffd\ufffd\f\ufffd5\ufffdu \ufffd\ufffd\u0000\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd\u0000[1,\ufffd\u00053\ufffd\ufffduCZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd0\ufffd\u001c\u07e7\ufffd\ufffd\ufffd\ufffdk^\u0016\u0006u\ufffd\ufffd\ufffdW$\u0005\ufffd-\ufffd\u0014\ufffd#\ufffdh\ufffd\u000b", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffd\ufffdr\ufffd\ufffd\u0013{\ufffd\ufffd\r\ufffd\ufffd\ufffd\bR\"\ufffd\ufffd\ufffd\u0019\ufffdx\ufffd\ufffd\f\ufffd5\ufffdu \ufffd\ufffd\u0000\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd\u0000[1,\ufffd\u00053\ufffd\ufffduCZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c34de3b4a5738ab6ab36c3089c50a632ad5d7b30", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffd\ufffdr\ufffd\ufffd\u0013{\ufffd\ufffd\r\ufffd\ufffd\ufffd\bR\"\ufffd\ufffd\ufffd\u0019\ufffdx\ufffd\ufffd\f\ufffd5\ufffdu \ufffd\ufffd\u0000\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd\u0000[1,\ufffd\u00053\ufffd\ufffduCZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd@\ufffd\ufffdr\ufffd\ufffd{\ufffd\ufffd\r\ufffd\ufffd\ufffdR\"\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd5\ufffdu \ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd[1,\ufffd3\ufffd\ufffduCZ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffd\ufffdr\ufffd\ufffd\u0013{\ufffd\ufffd\r\ufffd\ufffd\ufffd\bR\"\ufffd\ufffd\ufffd\u0019\ufffdx\ufffd\ufffd\f\ufffd5\ufffdu \ufffd\ufffd\u0000\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd\u0000[1,\ufffd\u00053\ufffd\ufffduCZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd@\ufffd\ufffdr\ufffd\ufffd{\ufffd\ufffd\r\ufffd\ufffd\ufffdR\"\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd5\ufffdu \ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd:\ufffd=\ufffd[1,\ufffd3\ufffd\ufffduCZ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��_�d�c.M��K�q� W�V��4�� l�� !��6��4ͣ�n7�^/�!�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��_�d�c.M��K�q� W�V��4�� l�� !��6��4ͣ�n7�^/�!�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��_�d�c.M��K�q� W�V��4�� l�� !��6��4ͣ�n7�^/�!�&�+�/�,�0̨̩� �� /5� w �+3&$ X��Q��(��A� X Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.7466048447703475, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "00eb7e88237c944ed9b00bdffa42ca66", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_\ufffdd\u0006\ufffdc.M\ufffd\ufffdK\ufffdq\u0017\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\u001f\ufffd\ufffd\u000f\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\u0017\u0013\u0007\ufffdn7\ufffd^\/\ufffd!\u0019\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_\ufffdd\u0006\ufffdc.M\ufffd\ufffdK\ufffdq\u0017\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\u001f\ufffd\ufffd\u000f\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\u0017\u0013\u0007\ufffdn7\ufffd^\/\ufffd!\u0019\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0007X\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0016\ufffd\ufffd\ufffd\bQ\ufffd\ufffd\ufffd\u0013(\u000f\ufffd\ufffd\u0001A\ufffd\u000bX\u0016", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_\ufffdd\u0006\ufffdc.M\ufffd\ufffdK\ufffdq\u0017\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\u001f\ufffd\ufffd\u000f\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\u0017\u0013\u0007\ufffdn7\ufffd^\/\ufffd!\u0019\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1473e088d5f61e19852eb23c4b5d6a3dc819886e", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_\ufffdd\u0006\ufffdc.M\ufffd\ufffdK\ufffdq\u0017\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\u001f\ufffd\ufffd\u000f\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\u0017\u0013\u0007\ufffdn7\ufffd^\/\ufffd!\u0019\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd_\ufffdd\ufffdc.M\ufffd\ufffdK\ufffdq\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\ufffdn7\ufffd^\/\ufffd!\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_\ufffdd\u0006\ufffdc.M\ufffd\ufffdK\ufffdq\u0017\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\u001f\ufffd\ufffd\u000f\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\u0017\u0013\u0007\ufffdn7\ufffd^\/\ufffd!\u0019\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd_\ufffdd\ufffdc.M\ufffd\ufffdK\ufffdq\ufffd\tW\ufffdV\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdl\ufffd\ufffd\ufffd\t\ufffd\ufffd!\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd4\u0363\ufffdn7\ufffd^\/\ufffd!\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��^�bLO _[b�Ce��%�![(�)�� gJ�/Lcم �ި��֯�P�T/�0gWջ�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��^�bLO _[b�Ce��%�![(�)�� gJ�/Lcم �ި��֯�P�T/�0gWջ�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��^�bLO _[b�Ce��%�![(�)�� gJ�/Lcم �ި��֯�P�T/�0gWջ�&�+�/�,�0̨̩� �� /5� w �+3&$ �/!% ��]A�&��4:4��C��abAթ� Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.8426501626769305, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "29a6cd2d2b62056951884d31c7dcd945", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd^\u000e\ufffd\u000fbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\u001e\ufffd\u05af\u001c\u000f\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd^\u000e\ufffd\u000fbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\u001e\ufffd\u05af\u001c\u000f\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\/!\u0019%\r\ufffd\ufffd\ufffd]A\ufffd&\ufffd\u001d\u0003\ufffd4:4\ufffd\ufffdC\ufffd\ufffdabA\u0569\ufffd\u0011", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd^\u000e\ufffd\u000fbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\u001e\ufffd\u05af\u001c\u000f\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c7e3c2f4ff40c4c177b34ea323ad2c41d5022958", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd^\u000e\ufffd\u000fbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\u001e\ufffd\u05af\u001c\u000f\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^\ufffdbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\ufffd\u05af\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd^\u000e\ufffd\u000fbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\u001e\ufffd\u05af\u001c\u000f\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^\ufffdbLO _[b\ufffdCe\ufffd\ufffd\ufffd%\ufffd![(\ufffd)\ufffd\ufffd\ufffd \ufffdgJ\ufffd\/Lc\u0645\t\ufffd\u07a8\ufffd\ufffd\u05af\ufffdP\ufffdT\/\ufffd0gW\u057b\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��f[S�x T �b4�R�)�7�/^u5NB� �Q��z�y5�aGu��Ζ^`~r�^��6.�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��f[S�xT �b4�R�)�7�/^u5NB� �Q��z�y5�aGu��Ζ^`~r�^��6.�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��f[S�x T �b4�R�)�7�/^u5NB� �Q��z�y5�aGu��Ζ^`~r�^��6.�&�+�/�,�0̨̩� �� /5� w �+3&$ t��: ��NO��;bN= �T�x��\6G�3 Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.837215600740334, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "2199214e90d48563b5f30665606622dd", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0019f[S\ufffdx\u000b\u0017T\t\ufffd\u001cb4\ufffdR\u0018\ufffd)\ufffd\u00157\ufffd\/^u5NB\ufffd \u001b\ufffdQ\ufffd\u0011\ufffdz\ufffdy5\ufffd\u001caGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0019f[S\ufffdx\u000b\u0017T\t\ufffd\u001cb4\ufffdR\u0018\ufffd)\ufffd\u00157\ufffd\/^u5NB\ufffd \u001b\ufffdQ\ufffd\u0011\ufffdz\ufffdy5\ufffd\u001caGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 t\ufffd\ufffd:\t\t\ufffd\ufffdNO\u0013\u0014\ufffd\ufffd\ufffd;bN=\u000b\ufffdT\ufffdx\ufffd\ufffd\\6G\ufffd3\u0014", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0019f[S\ufffdx\u000b\u0017T\t\ufffd\u001cb4\ufffdR\u0018\ufffd)\ufffd\u00157\ufffd\/^u5NB\ufffd \u001b\ufffdQ\ufffd\u0011\ufffdz\ufffdy5\ufffd\u001caGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "36a20febea9a25d9f3df0bcafef71bd91c881a20", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0019f[S\ufffdx\u000b\u0017T\t\ufffd\u001cb4\ufffdR\u0018\ufffd)\ufffd\u00157\ufffd\/^u5NB\ufffd \u001b\ufffdQ\ufffd\u0011\ufffdz\ufffdy5\ufffd\u001caGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdf[S\ufffdxT\t\ufffdb4\ufffdR\ufffd)\ufffd7\ufffd\/^u5NB\ufffd \ufffdQ\ufffd\ufffdz\ufffdy5\ufffdaGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0019f[S\ufffdx\u000b\u0017T\t\ufffd\u001cb4\ufffdR\u0018\ufffd)\ufffd\u00157\ufffd\/^u5NB\ufffd \u001b\ufffdQ\ufffd\u0011\ufffdz\ufffdy5\ufffd\u001caGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdf[S\ufffdxT\t\ufffdb4\ufffdR\ufffd)\ufffd7\ufffd\/^u5NB\ufffd \ufffdQ\ufffd\ufffdz\ufffdy5\ufffdaGu\ufffd\ufffd\u0396^`~r\ufffd^\ufffd\ufffd6.\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "behavior_alert_count": 1, "behavior_priority": 84 }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��[#N0�X�Kk�Ƈ}�>��v��Ƥ񧤾g� �I�scU;��SgD5]��P��m+gS�I��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��[#N0�X�Kk�Ƈ}�>��v��Ƥ񧤾g� �I�scU;��SgD5]��P��m+gS�I��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��[#N0�X�Kk�Ƈ}�>��v��Ƥ񧤾g� �I�scU;��SgD5]��P��m+gS�I��&�+�/�,�0̨̩� �� /5� w �+3&$ Q{^A�;]3 �!B<�s~� �i��a��܏ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.832055731816517, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "d2523a18f926232782f423cb40ee5e66", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3e\u0007g\ufffd \u000f\ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\u0012\ufffdP\ufffd\u0005\u0017\ufffdm+gS\ufffdI\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3e\u0007g\ufffd \u000f\ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\u0012\ufffdP\ufffd\u0005\u0017\ufffdm+gS\ufffdI\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Q{\u0019\u0003^A\ufffd;]3\u000b\ufffd!B<\ufffds~\ufffd\f\ufffdi\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\u070f\u0014", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3e\u0007g\ufffd \u000f\ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\u0012\ufffdP\ufffd\u0005\u0017\ufffdm+gS\ufffdI\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "263cb1b22f29346b6aecee7e7b9eed5b50f574e4", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3e\u0007g\ufffd \u000f\ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\u0012\ufffdP\ufffd\u0005\u0017\ufffdm+gS\ufffdI\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3eg\ufffd \ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\ufffdP\ufffd\ufffdm+gS\ufffdI\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3e\u0007g\ufffd \u000f\ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\u0012\ufffdP\ufffd\u0005\u0017\ufffdm+gS\ufffdI\u001c\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd[#N0\ufffdX\ufffdKk\ufffd\u0187}\ufffd>\ufffd\ufffd\ufffdv\ufffd\ufffd\u01a4\ud95e\udd3eg\ufffd \ufffdI\ufffdscU;\ufffd\ufffdSgD5]\ufffd\ufffdP\ufffd\ufffdm+gS\ufffdI\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��;��ܨ�� B;`�o铋e4 !�ulmu) �M��B�A��m/�� I;��f��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��;��ܨ�� B;`�o铋e4 !�ulmu) �M��B�A��m/�� I;��f��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��;��ܨ�� B;`�o铋e4 !�ulmu) �M��B�A��m/�� I;��f��&�+�/�,�0̨̩� �� /5� w �+3&$ �9�mc�P�>V::�r�L�}��<4\vj03p Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.810369612980814, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "394f6e5127b59c44f99b8f9efc5312ac", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd;\ufffd\ufffd\b\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u0018\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffd\u001fI;\ufffd\ufffdf\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd;\ufffd\ufffd\b\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u0018\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffd\u001fI;\ufffd\ufffdf\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd9\ufffdmc\ufffd\u0004P\ufffd>V::\ufffdr\ufffdL\ufffd}\ufffd\ufffd\ufffd<4\u000f\\vj0\u001b3p", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd;\ufffd\ufffd\b\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u0018\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffd\u001fI;\ufffd\ufffdf\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b5c1d925fe4663f9248a58afd36e37bd98e31aec", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd;\ufffd\ufffd\b\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u0018\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffd\u001fI;\ufffd\ufffdf\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffdI;\ufffd\ufffdf\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd;\ufffd\ufffd\b\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u0018\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffd\u001fI;\ufffd\ufffdf\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdB;`\ufffdo\u94cbe4 !\ufffdulmu)\r\ufffdM\ufffd\ufffdB\ufffdA\ufffd\ufffd\ufffdm\/\ufffd\ufffd\t\ufffdI;\ufffd\ufffdf\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��g�k:�L;��XfR��'i��M�F� ��v��!�:�t��/L@�v��:�Ôi&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��g�k:�L;��XfR��'i��M�F� ��v��!�:�t��/L@�v��:�Ôi&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��g�k:�L;��XfR��'i��M�F� ��v��!�:�t��/L@�v��:�Ôi&�+�/�,�0̨̩� �� /5� w �+3&$ ��^:7�._��f[\|m��I[�t:��@~ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.811976129497456, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "a627ddbbd80603557a90ad8e00847b29", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\u0010\ufffd\ufffd\u0017M\ufffdF\ufffd \u0000\ufffd\u0004\ufffd\u0015\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\u0014\ufffd\/L@\ufffdv\u0011\ufffd\ufffd\ufffd:\ufffd\u00d4i\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\u0010\ufffd\ufffd\u0017M\ufffdF\ufffd \u0000\ufffd\u0004\ufffd\u0015\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\u0014\ufffd\/L@\ufffdv\u0011\ufffd\ufffd\ufffd:\ufffd\u00d4i\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0014\ufffd\ufffd^:\u00157\ufffd._\ufffd\ufffd\u0019f[\u0002\|m\ufffd\ufffdI[\u001a\ufffdt:\ufffd\ufffd@~", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\u0010\ufffd\ufffd\u0017M\ufffdF\ufffd \u0000\ufffd\u0004\ufffd\u0015\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\u0014\ufffd\/L@\ufffdv\u0011\ufffd\ufffd\ufffd:\ufffd\u00d4i\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed45e867b9ce6ebb00432275f149b3631a212510", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\u0010\ufffd\ufffd\u0017M\ufffdF\ufffd \u0000\ufffd\u0004\ufffd\u0015\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\u0014\ufffd\/L@\ufffdv\u0011\ufffd\ufffd\ufffd:\ufffd\u00d4i\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\ufffd\ufffdM\ufffdF\ufffd \ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\ufffd\/L@\ufffdv\ufffd\ufffd\ufffd:\ufffd\u00d4i&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd\ufffd'i\ufffd\u0010\ufffd\ufffd\u0017M\ufffdF\ufffd \u0000\ufffd\u0004\ufffd\u0015\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\u0014\ufffd\/L@\ufffdv\u0011\ufffd\ufffd\ufffd:\ufffd\u00d4i\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdk:\ufffdL;\ufffd\ufffd\ufffd\ufffdXfR\ufffd*\ufffd'i\ufffd\ufffd\ufffdM\ufffdF\ufffd \ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd:\ufffdt\ufffd\ufffd\/L@\ufffdv\ufffd\ufffd\ufffd:\ufffd\u00d4i&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��Eo�?7��e��c.L��ō0V�� D\Q�E�X��+�gG/E%��^��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Eo�?7��e��c.L��ō0V�� D\Q�E�X��+�gG/E%��^��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��Eo�?7��e��c.L��ō0V�� D\Q�E�X��+�gG/E%��^��&�+�/�,�0̨̩� �� /5� w �+3&$ (��A�DL�Q�Ʒ&�q�$��Jpdq Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.7880401893057964, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "72ba8a570d070caf7dd267d287c904ea", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffd\u000f\ufffd\ufffdE\u001bo\ufffd?7\ufffd\ufffd\ufffde\u0018\u001e\u001d\ufffd\ufffdc.L\ufffd\u0000\ufffd\u014d0V\ufffd\ufffd D\\Q\u0004\ufffdE\u0013\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffd\u001cg\u0015G\/E%\ufffd\ufffd\ufffd\u001b\ufffd\u0003\ufffd^\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffd\u000f\ufffd\ufffdE\u001bo\ufffd?7\ufffd\ufffd\ufffde\u0018\u001e\u001d\ufffd\ufffdc.L\ufffd\u0000\ufffd\u014d0V\ufffd\ufffd D\\Q\u0004\ufffdE\u0013\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffd\u001cg\u0015G\/E%\ufffd\ufffd\ufffd\u001b\ufffd\u0003\ufffd^\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 (\u001e\ufffd\ufffdA\ufffd\u0018DL\ufffdQ\ufffd\u01b7&\ufffd\u000fq\ufffd$\ufffd\ufffd\ufffd\ufffd\u001d\ufffdJpdq", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffd\u000f\ufffd\ufffdE\u001bo\ufffd?7\ufffd\ufffd\ufffde\u0018\u001e\u001d\ufffd\ufffdc.L\ufffd\u0000\ufffd\u014d0V\ufffd\ufffd D\\Q\u0004\ufffdE\u0013\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffd\u001cg\u0015G\/E%\ufffd\ufffd\ufffd\u001b\ufffd\u0003\ufffd^\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e13df742c6dabcdf3851f3909041d67274246c3", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffd\u000f\ufffd\ufffdE\u001bo\ufffd?7\ufffd\ufffd\ufffde\u0018\u001e\u001d\ufffd\ufffdc.L\ufffd\u0000\ufffd\u014d0V\ufffd\ufffd D\\Q\u0004\ufffdE\u0013\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffd\u001cg\u0015G\/E%\ufffd\ufffd\ufffd\u001b\ufffd\u0003\ufffd^\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdEo\ufffd?7\ufffd\ufffd\ufffde\ufffd\ufffdc.L\ufffd\ufffd\u014d0V\ufffd\ufffd D\\Q\ufffdE\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffdgG\/E%\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffd\u000f\ufffd\ufffdE\u001bo\ufffd?7\ufffd\ufffd\ufffde\u0018\u001e\u001d\ufffd\ufffdc.L\ufffd\u0000\ufffd\u014d0V\ufffd\ufffd D\\Q\u0004\ufffdE\u0013\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffd\u001cg\u0015G\/E%\ufffd\ufffd\ufffd\u001b\ufffd\u0003\ufffd^\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdEo\ufffd?7\ufffd\ufffd\ufffde\ufffd\ufffdc.L\ufffd\ufffd\u014d0V\ufffd\ufffd D\\Q\ufffdE\ufffdX\ufffd\ufffd\ufffd\ufffd+\ufffdgG\/E%\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��VG��i��֟n2V�no� ��7'6��Y� �M}��K��B1�Z��@}7�B��'?�g&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��VG��i��֟n2V�no� ��7'6��Y� �M}��K��B1�Z��@}7�B��'?�g&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��VG��i��֟n2V�no� ��7'6��Y� �M}��K��B1�Z��@}7�B��'?�g&�+�/�,�0̨̩� �� /5� w �+3&$ �.洈��6^��ü7;��bar olz Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.8566458863921955, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "70a557e36e9697102236551102e0549f", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\u001c\ufffd\t\ufffd\ufffd7\u0017'6\ufffd\ufffdY\ufffd \ufffdM\u001d}\ufffd\ufffd\u0019\ufffd\u0004K\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}\u001e7\ufffd\u0019B\ufffd\ufffd'?\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\u001c\ufffd\t\ufffd\ufffd7\u0017'6\ufffd\ufffdY\ufffd \ufffdM\u001d}\ufffd\ufffd\u0019\ufffd\u0004K\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}\u001e7\ufffd\u0019B\ufffd\ufffd'?\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0003.\u6d08\u0013\ufffd\ufffd\ufffd\ufffd6^\ufffd\ufffd\u00fc7;\ufffd\ufffd\u0012\ufffdbar\folz", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\u001c\ufffd\t\ufffd\ufffd7\u0017'6\ufffd\ufffdY\ufffd \ufffdM\u001d}\ufffd\ufffd\u0019\ufffd\u0004K\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}\u001e7\ufffd\u0019B\ufffd\ufffd'?\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5d6ab84a762ad8afd4d425e807bd2004ee364f28", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\u001c\ufffd\t\ufffd\ufffd7\u0017'6\ufffd\ufffdY\ufffd \ufffdM\u001d}\ufffd\ufffd\u0019\ufffd\u0004K\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}\u001e7\ufffd\u0019B\ufffd\ufffd'?\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\ufffd\t\ufffd\ufffd7'6\ufffd\ufffdY\ufffd \ufffdM}\ufffd\ufffd\ufffdK\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}7\ufffdB\ufffd\ufffd'?\ufffdg&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\u001c\ufffd\t\ufffd\ufffd7\u0017'6\ufffd\ufffdY\ufffd \ufffdM\u001d}\ufffd\ufffd\u0019\ufffd\u0004K\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}\u001e7\ufffd\u0019B\ufffd\ufffd'?\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u059fn2V\ufffdno\ufffd\t\ufffd\ufffd7'6\ufffd\ufffdY\ufffd \ufffdM}\ufffd\ufffd\ufffdK\ufffd\ufffdB1\ufffdZ\ufffd\ufffd\ufffd@}7\ufffdB\ufffd\ufffd'?\ufffdg&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��}w]��Ed� H��;�p��%�=�cܖ�� v��b�mSm�x�(�Ex��R��Z`�&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��}w]��Ed� H��;�p��%�=�cܖ�� v��b�mSm�x�(�Ex��R��Z`�&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��}w]��Ed� H��;�p��%�=�cܖ�� v��b�mSm�x�(�Ex��R��Z`�&�+�/�,�0̨̩� �� /5� w �+3&$ ��1�/8>�(�8#�R�;6;(gw��_ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.76622193146879, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "ae88b7b47fa342d2afa0f9749e69d4fa", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\u0013\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\u0001\u0006\ufffd\ufffdR\ufffd\ufffdZ`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\u0013\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\u0001\u0006\ufffd\ufffdR\ufffd\ufffdZ`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0005\ufffd\ufffd\ufffd1\ufffd\/8>\ufffd\u0016(\ufffd8#\ufffdR\ufffd;\u00036;(gw\ufffd\ufffd\ufffd\u0005_", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\u0013\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\u0001\u0006\ufffd\ufffdR\ufffd\ufffdZ`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9eccc1eb0443e1643099a8049e0fe81c4017260", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\u0013\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\u0001\u0006\ufffd\ufffdR\ufffd\ufffdZ`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdZ`\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\u0013\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\u0001\u0006\ufffd\ufffdR\ufffd\ufffdZ`\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd}w]\ufffd\ufffd\ufffd\ufffdEd\ufffd H\ufffd\ufffd\ufffd\ufffd;\ufffdp\ufffd\ufffd%\ufffd=\ufffdc\u0716\ufffd\ufffd v\ufffd\ufffdb\ufffdmSm\ufffdx\ufffd(\ufffdEx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdZ`\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��a��ei��9E� )�/�!�WƦ#i�� }pNM�6}�A��%�pj��l��NV��X��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��a��ei��9E�)�/�!�WƦ#i�� }pNM�6}�A��%�pj��l��NV��X��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��a��ei��9E� )�/�!�WƦ#i�� }pNM�6}�A��%�pj��l��NV��X��&�+�/�,�0̨̩� �� /5� w �+3&$ ��e1��_u��J�X��샍�/ Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.9262240892503115, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "f0af3326dcb98a849175d1cd2fcb4684", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\b\ufffdei\ufffd\u000e\ufffd9E\ufffd\f\u001f)\ufffd\/\ufffd!\ufffdW\u0007\u0018\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\u0010\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\b\ufffdei\ufffd\u000e\ufffd9E\ufffd\f\u001f)\ufffd\/\ufffd!\ufffdW\u0007\u0018\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\u0010\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffde1\u0016\ufffd\ufffd\ufffd_u\u0003\u001f\ufffd\u0014\ufffd\ufffd\ufffd\ufffdJ\ufffdX\ufffd\ufffd\ufffd\ufffd\u001c\uc0cd\ufffd\/", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\b\ufffdei\ufffd\u000e\ufffd9E\ufffd\f\u001f)\ufffd\/\ufffd!\ufffdW\u0007\u0018\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\u0010\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f2065094fe380136e91e756e15638c05989a1826", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\b\ufffdei\ufffd\u000e\ufffd9E\ufffd\f\u001f)\ufffd\/\ufffd!\ufffdW\u0007\u0018\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\u0010\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffda\ufffd\ufffd\ufffd\ufffdei\ufffd\ufffd9E\ufffd)\ufffd\/\ufffd!\ufffdW\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\b\ufffdei\ufffd\u000e\ufffd9E\ufffd\f\u001f)\ufffd\/\ufffd!\ufffdW\u0007\u0018\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\u0010\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffda\ufffd\ufffd\ufffd\ufffdei\ufffd\ufffd9E\ufffd)\ufffd\/\ufffd!\ufffdW\u01a6#i\ufffd\ufffd }pNM\ufffd6}\ufffdA\ufffd\ufffd%\ufffdpj\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdNV\ufffd\ufffdX\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��꫇:Jj<�5D�v�,whLULB�@ޮ�5� ^(��[�E�5K��Х� ��.�k�#��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��꫇:Jj<�5D�v�,whLULB�@ޮ�5� ^(��[�E�5K��Х� ��.�k�#��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��꫇:Jj<�5D�v�,whLULB�@ޮ�5� ^(��[�E�5K��Х� ��.�k�#��&�+�/�,�0̨̩� �� /5� w �+3&$ �.��W ��㳥��\�_ n��+��UP Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.838879940188802, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "ee355178c6b93bee087cc26e36343160", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\uaac7:Jj\u0001<\ufffd5D\ufffdv\u0014\ufffd,whLULB\ufffd@\u07ae\u000f\u000f\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\u000e\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\u0007\ufffd\u0016k\ufffd#\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\uaac7:Jj\u0001<\ufffd5D\ufffdv\u0014\ufffd,whLULB\ufffd@\u07ae\u000f\u000f\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\u000e\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\u0007\ufffd\u0016k\ufffd#\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdW\u0017\t\ufffd\ufffd\u0007\u3ce5\ufffd\ufffd\ufffd\\\ufffd_\u000bn\ufffd\ufffd+\ufffd\ufffdUP", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\uaac7:Jj\u0001<\ufffd5D\ufffdv\u0014\ufffd,whLULB\ufffd@\u07ae\u000f\u000f\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\u000e\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\u0007\ufffd\u0016k\ufffd#\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6195ab62b744b25797b07554ee4a286956ef89f6", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\uaac7:Jj\u0001<\ufffd5D\ufffdv\u0014\ufffd,whLULB\ufffd@\u07ae\u000f\u000f\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\u000e\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\u0007\ufffd\u0016k\ufffd#\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\uaac7:Jj<\ufffd5D\ufffdv\ufffd,whLULB\ufffd@\u07ae\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\ufffdk\ufffd#\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\uaac7:Jj\u0001<\ufffd5D\ufffdv\u0014\ufffd,whLULB\ufffd@\u07ae\u000f\u000f\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\u000e\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\u0007\ufffd\u0016k\ufffd#\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\uaac7:Jj<\ufffd5D\ufffdv\ufffd,whLULB\ufffd@\u07ae\ufffd5\ufffd ^(\ufffd\ufffd\ufffd[\ufffdE\ufffd5K\ufffd\ufffd\ufffd\u0425\ufffd\r\ufffd\ufffd.\ufffdk\ufffd#\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��X�p�!��d�.tU.��)(-q��ܹ� �B ÅY��$��G�Vm�랠a� A&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��X�p�!��d�.tU.��)(-q��ܹ� �B ÅY��$��G�Vm�랠a� A&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��X�p�!��d�.tU.��)(-q��ܹ� �B ÅY��$��G�Vm�랠a� A&�+�/�,�0̨̩� �� /5� w �+3&$ Fkب�}��#�%Z�ۅ(t�fhɄ���7~j Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.852457816748791, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "a3151f20cc1b097d1ca833dc06d5cf3c", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\u0001p\ufffd!\u0006\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-\u0007q\ufffd\u001a\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd\u0015$\ufffd\u001a\ufffd\ufffd\ufffd\u000eG\u0011\b\u0006\ufffdVm\ufffd\ub7a0a\ufffd\t\u0016A\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\u0001p\ufffd!\u0006\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-\u0007q\ufffd\u001a\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd\u0015$\ufffd\u001a\ufffd\ufffd\ufffd\u000eG\u0011\b\u0006\ufffdVm\ufffd\ub7a0a\ufffd\t\u0016A\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Fk\u0628\ufffd}\ufffd\ufffd\u001b#\ufffd%Z\ufffd\u06c5(t\ufffdfh\u0244\ufffd\u0006\ufffd\ufffd\ufffd7~j", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\u0001p\ufffd!\u0006\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-\u0007q\ufffd\u001a\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd\u0015$\ufffd\u001a\ufffd\ufffd\ufffd\u000eG\u0011\b\u0006\ufffdVm\ufffd\ub7a0a\ufffd\t\u0016A\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4bf2099ed439eaf217df0ff74a12a9c9e409801e", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\u0001p\ufffd!\u0006\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-\u0007q\ufffd\u001a\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd\u0015$\ufffd\u001a\ufffd\ufffd\ufffd\u000eG\u0011\b\u0006\ufffdVm\ufffd\ub7a0a\ufffd\t\u0016A\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdX\ufffdp\ufffd!\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-q\ufffd\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffdG\ufffdVm\ufffd\ub7a0a\ufffd\tA&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\u0001p\ufffd!\u0006\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-\u0007q\ufffd\u001a\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd\u0015$\ufffd\u001a\ufffd\ufffd\ufffd\u000eG\u0011\b\u0006\ufffdVm\ufffd\ub7a0a\ufffd\t\u0016A\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdX\ufffdp\ufffd!\ufffd\ufffdd\ufffd.tU.\ufffd\ufffd\ufffd)(-q\ufffd\ufffd\ufffd\u0739\ufffd \ufffdB\r\u00c5Y\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffdG\ufffdVm\ufffd\ub7a0a\ufffd\tA&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · TLS	tls	Sonde TLS tls probe · via TLS:2525 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 19e29534fd49dd27 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service TLS Payload ��H�}��q e)��H�'9F��٬��ؾ�� :��P�(�YQf��P��WyIHG��\|@��P��&�+�/�,�0̨̩� �� /5� w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��H�}��q e)��H�'9F��٬��ؾ�� :��P�(�YQf��P��WyIHG��\|@��P��&�+�/�,�0̨̩� �� /5� w Requête brute (extrait) ��H�}��q e)��H�'9F��٬��ؾ�� :��P�(�YQf��P��WyIHG��\|@��P��&�+�/�,�0̨̩� �� /5� w �+3&$ �aR{�4�¶�f�ϞOh�r��I��cPq Meta JSON brut { "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 239, "payload_entropy": 5.858399381958305, "port_category": "registered", "org": "GOOGL-2", "service": "tls", "app_proto": "tls", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70836d31869a19f9ea12fae07404daf9d0307458", "event_fingerprint": "cdcaabb8ab03842153e152487fabaef52c17c0e9", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "19e29534fd49dd27d09234e639c4057e", "payload_hash": "c839a34b0886403f79806ae214942674", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 2525, "service": "tls", "service_name": "tls", "risk_score": 24 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\u0010\u0007\ufffd'9F\ufffd\u0007\ufffd\u066c\ufffd\ufffd\u063e\u0004\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\u001e\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\u0010\u0007\ufffd'9F\ufffd\u0007\ufffd\u066c\ufffd\ufffd\u063e\u0004\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\u001e\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdaR{\ufffd4\ufffd\u00b6\ufffd\u001af\ufffd\u03deOh\ufffdr\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004cPq", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\u0010\u0007\ufffd'9F\ufffd\u0007\ufffd\u066c\ufffd\ufffd\u063e\u0004\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\u001e\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d33f56a89e27e0b14961336f992e21ba551b6b5a", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\u0010\u0007\ufffd'9F\ufffd\u0007\ufffd\u066c\ufffd\ufffd\u063e\u0004\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\u001e\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\ufffd'9F\ufffd\ufffd\u066c\ufffd\ufffd\u063e\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\u0010\u0007\ufffd'9F\ufffd\u0007\ufffd\u066c\ufffd\ufffd\u063e\u0004\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\u001e\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "19e29534fd49dd27d09234e639c4057e", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 2525, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffd}\ufffd\ufffd\ufffdq\re)\ufffd\ufffdH\ufffd'9F\ufffd\ufffd\u066c\ufffd\ufffd\u063e\ufffd\ufffd :\ufffd\ufffdP\ufffd(\ufffdYQf\ufffd\ufffd\ufffdP\ufffd\ufffdWyIHG\ufffd\ufffd\|@\ufffd\ufffdP\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw", "target_port_label": "2525 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /.git/config UA Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "git\/config", "http_ua_hash": "6cfc36b291e3e856fac814c99263228fac39f41f", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 251, "payload_entropy": 5.406543570836446, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 8, "anomaly_count": 0, "campaign_key": "9b479a6dfcce9036caffcb8545f8f43382816c0c", "event_fingerprint": "a16da6d604c912cab56501bd1fe9fbddc79c1839", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b853a41fb0c141aa0c3c1425c82b714e", "payload_hash": "e9090553c6a17afcf89a400583d34848", "path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML", "method": "GET", "path": "\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/.git\/config HTTP\/1.1", "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML", "evidence": { "method": "GET", "path": "\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/.git\/config HTTP\/1.1", "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "36c79199c1bbf9b6d5c16eea5cc7b6dccf9b4e02", "protocol_details": { "http_method": "GET", "http_path": "\/.git\/config", "request_line": "GET \/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/.git\/config", "request_line": "GET \/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config", "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_probe_git", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /app/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /app/.git/config UA Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit/537.36… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /app/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /app/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /app/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /app/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit/537.3 Requête brute (extrait) GET /app/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "bd0900aa2772f5fa2f57c0b9941249432ac41c80", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "c0d576333b61f38bb5785040d2824435407a4c84", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 260, "payload_entropy": 5.4116647133612075, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "c001dba6f88d3ac3a8caaed7daea4e2ab585c8c3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ef9094703e4392745c199301e0442435", "payload_hash": "e584a96dac47ad81c9002acf544778f3", "path_pattern_hash": "87d63e686c8d80bd28afc993649c7598" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.3", "method": "GET", "path": "\/app\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/app\/.git\/config HTTP\/1.1", "request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close", "payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/app\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/app\/.git\/config HTTP\/1.1", "request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close", "payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d0babf35c7701a9e0c4033fcfcf77c63776e2cb", "protocol_details": { "http_method": "GET", "http_path": "\/app\/.git\/config", "request_line": "GET \/app\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.3", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/app\/.git\/config", "request_line": "GET \/app\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config", "evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit\/537.3", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /src/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /src/.git/config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /src/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /src/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /src/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /src/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/53 Requête brute (extrait) GET /src/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "7c3242365fe7f8d40d141f81d9f83685656010a2", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "46e050e820087702ef14a381ebad48881db62e31", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 256, "payload_entropy": 5.403241787190853, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "86a9e44b6ae4e2c5ca818c1485bf25318f660c03", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "30d1cfe8ce0ea936f7d1da51cd060266", "payload_hash": "72ed47f913b37a2cb34b9d3a6e77767a", "path_pattern_hash": "83762003e224a5603ed7ad8ff32c59fc" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/53", "method": "GET", "path": "\/src\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/src\/.git\/config HTTP\/1.1", "request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/src\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/src\/.git\/config HTTP\/1.1", "request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/53", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a1570807ef6437bd2d9388db512c5e3ec430f54e", "protocol_details": { "http_method": "GET", "http_path": "\/src\/.git\/config", "request_line": "GET \/src\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/53", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/src\/.git\/config", "request_line": "GET \/src\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config", "evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/53", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /backend/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /backend/.git/config UA Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /backend/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /backend/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /backend/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36 EdgA/42.0.2.3819 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /backend/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.3 Requête brute (extrait) GET /backend/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36 EdgA/42.0.2.3819 Accept-Charset: utf-8 Accept-Encoding: gzip C Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "d0b32e6b556f817809a1967927b8d8d2e7678b0a", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "2482ac6c987d570b89dfba6cfee3dc3ac194789d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 276, "payload_entropy": 5.423311429992353, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "cf5f00e67164b83656d710848a62f32ad039c518", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b23dbbd191472317e2f36acdeb2915f6", "payload_hash": "6360819a320339ed6e6edd46a4e0e043", "path_pattern_hash": "2de751ea5a34e7a22b69004dc29faa62" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.3", "method": "GET", "path": "\/backend\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.36 EdgA\/42.0.2.3819", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/backend\/.git\/config HTTP\/1.1", "request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.36 EdgA\/42.0.2.3819\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC", "payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/backend\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.36 EdgA\/42.0.2.3819", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/backend\/.git\/config HTTP\/1.1", "request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.36 EdgA\/42.0.2.3819\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC", "payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff612220cd1e063c0dc433d479625366ad89e755", "protocol_details": { "http_method": "GET", "http_path": "\/backend\/.git\/config", "request_line": "GET \/backend\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.3\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.3", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/backend\/.git\/config", "request_line": "GET \/backend\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.90 Mobile Safari\/537.3\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config", "evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G965F) AppleWebKit\/537.3", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /frontend/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /frontend/.git/config UA Opera/9.80 (X11; Linux i686) Presto/2.12.388 Version/12.16 Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /frontend/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /frontend/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /frontend/.git/config HTTP/1.1` User-Agent Opera/9.80 (X11; Linux i686) Presto/2.12.388 Version/12.16 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /frontend/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Opera/9.80 (X11; Linux i686) Presto/2.12.388 Version/12.1 Requête brute (extrait) GET /frontend/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Opera/9.80 (X11; Linux i686) Presto/2.12.388 Version/12.16 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "92bf09d6d5b04766787d6daa8754d6c469e16ccc", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "79637aca3de7d81f8030ec893ab364d04845083c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 198, "payload_entropy": 5.172847979392398, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "de5b1a70b5e99b8c77a57c4ba2860721d5cb7db6", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9426bba269712bc8a4a40109a13e67eb", "payload_hash": "e2df2b647a888246aec1085d8654531c", "path_pattern_hash": "916bc8abf1fa018cce797ab5bdb418f0" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.1", "method": "GET", "path": "\/frontend\/.git\/config", "user_agent": "Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/frontend\/.git\/config HTTP\/1.1", "request_sample": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.1", "evidence": { "method": "GET", "path": "\/frontend\/.git\/config", "user_agent": "Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/frontend\/.git\/config HTTP\/1.1", "request_sample": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.1", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "156982e582294502b9480f3095f34d50d80a086f", "protocol_details": { "http_method": "GET", "http_path": "\/frontend\/.git\/config", "request_line": "GET \/frontend\/.git\/config HTTP\/1.1", "http_user_agent": "Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.1", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/frontend\/.git\/config", "request_line": "GET \/frontend\/.git\/config HTTP\/1.1", "http_user_agent": "Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.16", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.git\/config", "evidence_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Opera\/9.80 (X11; Linux i686) Presto\/2.12.388 Version\/12.1", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /api/.git/config	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /api/.git/config UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 31 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /api/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /api/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 63 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /api/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 k8s-api Payload (extrait) GET /api/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (K Requête brute (extrait) GET /api/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "dc8dbb5da86d22c7ae626b2995b7029591736e6a", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 249, "payload_entropy": 5.405856051652641, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 9, "anomaly_count": 0, "campaign_key": "29058bd73521c6455dddf8c366de4ed2fdc34b50", "event_fingerprint": "ad6921f25341495b7980e79aa7dc0c5a5d540c50", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "af51ca2270e25a7991d59a6b351817d9", "payload_hash": "5f7808b4a78fc4008f3999cdb47301cb", "path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (K", "method": "GET", "path": "\/api\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0", "k8s-api" ], "request_line": "GET \/api\/.git\/config HTTP\/1.1", "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (K", "evidence": { "method": "GET", "path": "\/api\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0", "k8s-api" ], "request_line": "GET \/api\/.git\/config HTTP\/1.1", "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (K", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4d55dcfb11c4faa4d46097ea7303a30b08ea6b4", "protocol_details": { "http_method": "GET", "http_path": "\/api\/.git\/config", "request_line": "GET \/api\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (K", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/.git\/config", "request_line": "GET \/api\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config", "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (K", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api", "http_backup_file_scan", "http_git_exposure", "http_probe_api", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /v2/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /v2/.git/config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/201001… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950316:lfi-14 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /v2/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /v2/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v2/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0 Règles WAF lfi-14 rce-0 nosqli-3 leak-0 Payload (extrait) GET /v2/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/201001 Requête brute (extrait) GET /v2/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "de7ae3d01370a40b6ce3154d68446553e65f8441", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "3a5f2466c34928bb38a61b739c70bfc69a077a30", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 212, "payload_entropy": 5.2868508931694524, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 8, "anomaly_count": 0, "campaign_key": "05e5d96729446bed1f001919b70ed8d3c2faf7ae", "event_fingerprint": "0314f8a9fb126bea24bd8b9c12b2684dc34deb93", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7786eb1e38ed3569c8d6f2bc27ee566e", "payload_hash": "95ff529488c5d498c03949f90d280097", "path_pattern_hash": "fcafe4006602b874bcf9d18118e88566" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/201001", "method": "GET", "path": "\/v2\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/v2\/.git\/config HTTP\/1.1", "request_sample": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/201001", "evidence": { "method": "GET", "path": "\/v2\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/v2\/.git\/config HTTP\/1.1", "request_sample": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/201001", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe9f51b4501d9b97868a657bcf782ea5e2f9156f", "protocol_details": { "http_method": "GET", "http_path": "\/v2\/.git\/config", "request_line": "GET \/v2\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/201001", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/v2\/.git\/config", "request_line": "GET \/v2\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.git\/config", "evidence_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/201001", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /v3/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /v3/.git/config UA Mozilla/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit/605.1… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950316:lfi-14 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /v3/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /v3/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v3/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1 Règles WAF lfi-14 rce-0 nosqli-3 leak-0 Payload (extrait) GET /v3/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit/605.1 Requête brute (extrait) GET /v3/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "2c0aeb015b4e51aa7a91997a0983cebfb71ef0be", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "4bf76a52a29633f52f17f2cac5ee4daa8e021adb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 262, "payload_entropy": 5.389864261842416, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 8, "anomaly_count": 0, "campaign_key": "05e5d96729446bed1f001919b70ed8d3c2faf7ae", "event_fingerprint": "137483b5dd70971281692a8375e926f046ca593a", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f94a8f5a34ea88691ad4ed66c7676619", "payload_hash": "fb743d4b9356ed7fc5b512c47e14d971", "path_pattern_hash": "4562786c79a4c5f0790c3581071f5847" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1", "method": "GET", "path": "\/v3\/.git\/config", "user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/v3\/.git\/config HTTP\/1.1", "request_sample": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo", "payload_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1", "evidence": { "method": "GET", "path": "\/v3\/.git\/config", "user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/v3\/.git\/config HTTP\/1.1", "request_sample": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo", "payload_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d7587b3b253798f1142f393f0fb3725776c486e", "protocol_details": { "http_method": "GET", "http_path": "\/v3\/.git\/config", "request_line": "GET \/v3\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Saf\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/v3\/.git\/config", "request_line": "GET \/v3\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Mobile\/15E148 Saf\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.git\/config", "evidence_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit\/605.1", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /v1/.git/config	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /v1/.git/config UA Mozilla/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M… Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950316:lfi-14 950326:rce-0 950406:ssrf-3 950468:nosqli-3 Cible HTTP GET /v1/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /v1/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 63 Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v1/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile/2.1; http://www.google.com/bot.html) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 leak-0 Payload (extrait) GET /v1/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M Requête brute (extrait) GET /v1/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile/2.1; http://www.google.com/bot.html) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "7702a76b74d49f9caa4550b75db69f924d759257", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "852e68c3e2549d34d36a9b5a3605571990e68c97", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 240, "payload_entropy": 5.201594906218925, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 9, "anomaly_count": 0, "campaign_key": "682e20cdbc3bf7b1dbb5d0ebab06bfc6c361ba15", "event_fingerprint": "d5bc848840cad2125b6d43176bdc2274475fa2f6", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b62c9a022d4348c96091e201d3d75543", "payload_hash": "7157cac6f8857ac7de9062a6943c81d0", "path_pattern_hash": "0efea7c22b821f254abb056b9239c5c5" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M", "method": "GET", "path": "\/v1\/.git\/config", "user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "leak-0" ], "request_line": "GET \/v1\/.git\/config HTTP\/1.1", "request_sample": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M", "evidence": { "method": "GET", "path": "\/v1\/.git\/config", "user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "leak-0" ], "request_line": "GET \/v1\/.git\/config HTTP\/1.1", "request_sample": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4e0b6820def33024f97ece41cb4fe371d5f0afa", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/.git\/config", "request_line": "GET \/v1\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/.git\/config", "request_line": "GET \/v1\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile\/2.1; http:\/\/www.google.com\/bot.html)", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/.git\/config", "evidence_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-M", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /web/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /web/.git/config UA Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /web/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /web/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /web/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+ Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /web/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi Requête brute (extrait) GET /web/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+ Accept-Charset: utf-8 Accept-Encoding: gzip Connection: Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "73ff5f2861619eda9d219e9882dfbb30ba8b53ef", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "f32c2ab0d87a20f2415a1cf44997c48739d87917", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 266, "payload_entropy": 5.431908801340784, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "e096d378d5119a824a31127e1403a222557693f0", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7409a57aca9dbd2b42e0907ef1e661bd", "payload_hash": "4872a142e5c92b4a8f81747104e6ea7a", "path_pattern_hash": "2be87edfa036da6580e700b188114b92" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi", "method": "GET", "path": "\/web\/.git\/config", "user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Safari\/534.11+", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/web\/.git\/config HTTP\/1.1", "request_sample": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Safari\/534.11+\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:", "payload_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi", "evidence": { "method": "GET", "path": "\/web\/.git\/config", "user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Safari\/534.11+", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/web\/.git\/config HTTP\/1.1", "request_sample": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Safari\/534.11+\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:", "payload_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4d17a479a81ed6cc9972647c395d6c42628489d", "protocol_details": { "http_method": "GET", "http_path": "\/web\/.git\/config", "request_line": "GET \/web\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Sa\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/web\/.git\/config", "request_line": "GET \/web\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit\/534.11+ (KHTML, like Gecko) Version\/7.1.0.267 Mobile Sa\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.git\/config", "evidence_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKi", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /www/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /www/.git/config UA Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /www/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /www/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /www/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) coc_coc_browser/80.0.180 Chrome/74.0.3729.180 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /www/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /www/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) coc_coc_browser/80.0.180 Chrome/74.0.3729.180 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connect Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "9a648c59dc1ccd46f17d79f10dfab373023bd250", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "7b5c6d1b9506a8d5fe958dbcf1ffdcdd61f34f9e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 270, "payload_entropy": 5.4312774225416565, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "175ac65ec9397d5687652a1c6d89aa2096937f35", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "abe549b65656f0d240af7f3f892c6538", "payload_hash": "4b8ce72f01654b602c67edcbfe621274", "path_pattern_hash": "2067f182832f5bbc5f3205656471af53" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML", "method": "GET", "path": "\/www\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/www\/.git\/config HTTP\/1.1", "request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect", "payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML", "evidence": { "method": "GET", "path": "\/www\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/www\/.git\/config HTTP\/1.1", "request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect", "payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f76541d60c0e8eeed0de6cd7a60fecaf06e7cfc4", "protocol_details": { "http_method": "GET", "http_path": "\/www\/.git\/config", "request_line": "GET \/www\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.1\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/www\/.git\/config", "request_line": "GET \/www\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.1\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config", "evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /html/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /html/.git/config UA Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleWeb… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /html/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /html/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /html/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.97 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /html/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleW Requête brute (extrait) GET /html/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.97 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connect Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "49e2b9bfe0b85ee22412afa4b7905242665cdd17", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "ed148acba970ce3061829b4dd97608d1a6997773", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 270, "payload_entropy": 5.438309013419116, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "229f2420defeb9f205240901109d92a499c5d999", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "71a4b552c96750f2e2a040ceed8e3db9", "payload_hash": "ed3fa75ff4203c304b0fa2cb7c3a7dc6", "path_pattern_hash": "985e825857a4aae20b7bcc62b05870c4" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleW", "method": "GET", "path": "\/html\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/html\/.git\/config HTTP\/1.1", "request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect", "payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleW", "evidence": { "method": "GET", "path": "\/html\/.git\/config", "user_agent": "Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/html\/.git\/config HTTP\/1.1", "request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect", "payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleW", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d11b51ca0c8adef705469b69cb87bf30c87f45b7", "protocol_details": { "http_method": "GET", "http_path": "\/html\/.git\/config", "request_line": "GET \/html\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobil\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleW", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/html\/.git\/config", "request_line": "GET \/html\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.97 Mobil\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config", "evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; LG-D850 Build\/MRA58K) AppleW", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /htdocs/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /htdocs/.git/config UA Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /htdocs/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /htdocs/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /htdocs/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /htdocs/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/6 Requête brute (extrait) GET /htdocs/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: c Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "d454d41c08f95ce5378b30344443356bc367775e", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "91751256d60394a8b0340bb86ad1a8313b8dadfa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 264, "payload_entropy": 5.374728079115337, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "4e9ffcb10f40d40cdf942e7cc9b0a54a791b2ed4", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ca3543a0490b39e86ccc99e17d9d93d", "payload_hash": "d875a7d78e6a59bc2755c7af3c6210d1", "path_pattern_hash": "9d5b4b02a118c63f9864fb4303c2c2fa" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/6", "method": "GET", "path": "\/htdocs\/.git\/config", "user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1", "request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c", "payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/6", "evidence": { "method": "GET", "path": "\/htdocs\/.git\/config", "user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1", "request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c", "payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/6", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28c6fb77c32ed10f7596c9d78efbf63509e58db5", "protocol_details": { "http_method": "GET", "http_path": "\/htdocs\/.git\/config", "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safar\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/6", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/htdocs\/.git\/config", "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safar\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config", "evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit\/6", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /public/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /public/.git/config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /public/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /public/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /public/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /public/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit Requête brute (extrait) GET /public/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "87714776a81642cc8483a46c9b386e769e683fe6", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "8257582ae447b9a2124e0414764cac0aac8808de", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 255, "payload_entropy": 5.350590031409006, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "649a2d019593c83c46d29415225df49e0f14b172", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "37904114285671e34c5108f65a8f0e1e", "payload_hash": "4b53bab778d8cfa4455ff715c05fd88a", "path_pattern_hash": "78b85c05b86f9869fecb7907511b414c" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit", "method": "GET", "path": "\/public\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/public\/.git\/config HTTP\/1.1", "request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit", "evidence": { "method": "GET", "path": "\/public\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/public\/.git\/config HTTP\/1.1", "request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0d3eff466cf65657dd97f7436a81dd281750632", "protocol_details": { "http_method": "GET", "http_path": "\/public\/.git\/config", "request_line": "GET \/public\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/public\/.git\/config", "request_line": "GET \/public\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config", "evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /static/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /static/.git/config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /static/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /static/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /static/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.119 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /static/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit Requête brute (extrait) GET /static/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.119 Accept-Charset: utf-8 Accept-Encoding: gzip Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "399581a15da0b9ac99767c7d2c8d0423487aa74a", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "521a53c26ae63c9f634cf4a8753a3e9a31c14380", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 277, "payload_entropy": 5.3973995955918, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 8, "anomaly_count": 0, "campaign_key": "011d0760d4269934a405e2c2685dc3fceab5683f", "event_fingerprint": "880f0822cb417c07f5052f1476618ae3053e4a10", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8cbb26a0b3a744890bf6e29471122e4d", "payload_hash": "0380d9eb8c4961e637f138de3970754f", "path_pattern_hash": "8991b5397bf20ed66988d72bf753894a" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit", "method": "GET", "path": "\/static\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.119", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/static\/.git\/config HTTP\/1.1", "request_sample": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.119\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\n", "payload_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit", "evidence": { "method": "GET", "path": "\/static\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.119", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/static\/.git\/config HTTP\/1.1", "request_sample": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.119\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\n", "payload_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce571097d807219d8377a1f4e5a90261883908e1", "protocol_details": { "http_method": "GET", "http_path": "\/static\/.git\/config", "request_line": "GET \/static\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/static\/.git\/config", "request_line": "GET \/static\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/.git\/config", "evidence_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_probe_static", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /assets/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /assets/.git/config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /assets/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /assets/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /assets/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /assets/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G Requête brute (extrait) GET /assets/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "f98a65e7aaa2a674609ce0e58c31530c28b5189b", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "e81ca9a0554d6690b053d3acc558b05833b1c696", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 225, "payload_entropy": 5.233881668706291, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 8, "anomaly_count": 0, "campaign_key": "1196c46dd28d1c348cc90b1aa146f843fd910dbd", "event_fingerprint": "aa9aca158f81ee11affc2c9e8f0d390e3bc603c2", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8fac6af1320ab85eee6a8c24e6cff7d0", "payload_hash": "17da953cf50ecb6680df45cd5c90bdfe", "path_pattern_hash": "70c13b709566f458c71892575aa001e0" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G", "method": "GET", "path": "\/assets\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/assets\/.git\/config HTTP\/1.1", "request_sample": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G", "evidence": { "method": "GET", "path": "\/assets\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/assets\/.git\/config HTTP\/1.1", "request_sample": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60728f13950e7a98a68ad5cbb504e22203cc468c", "protocol_details": { "http_method": "GET", "http_path": "\/assets\/.git\/config", "request_line": "GET \/assets\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/assets\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/assets\/.git\/config", "request_line": "GET \/assets\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/assets\/.git\/config", "evidence_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) G", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_probe_assets", "http_sensitive_path" ], "behavior_alert_count": 1, "behavior_priority": 72 }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /dist/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /dist/.git/config UA Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /dist/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /dist/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /dist/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3875.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /dist/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 ( Requête brute (extrait) GET /dist/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3875.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "ff5f1a3cb9b97b83a69c684a782fe68d69100bc2", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "b2ec2395164738dbd60ce81f264be6255104bfff", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 248, "payload_entropy": 5.397488918048599, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "c70022a9bcaf90c9d4b83db4b56012c53b58ec35", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8171ca5a2d32a6c4387a85942c8677e1", "payload_hash": "9695bead27f767cd59459af7809c9c35", "path_pattern_hash": "dd1606cd54dc95eed2c024184678427e" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (", "method": "GET", "path": "\/dist\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/dist\/.git\/config HTTP\/1.1", "request_sample": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/dist\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/dist\/.git\/config HTTP\/1.1", "request_sample": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70f3f99e929dc5e6a0fe3565a3591ca35cb9c020", "protocol_details": { "http_method": "GET", "http_path": "\/dist\/.git\/config", "request_line": "GET \/dist\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/dist\/.git\/config", "request_line": "GET \/dist\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3875.0 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.git\/config", "evidence_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /build/.git/config	Élevée	Moyen · 49
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /build/.git/config UA SearchExpress Émulateur HTTP WAF 14 Recommandation Surveiller Tags 950468:nosqli-3 950513:leak-0 http_backup_file_scan http_git_exposure Cible HTTP GET /build/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /build/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /build/.git/config HTTP/1.1` User-Agent SearchExpress Règles WAF nosqli-3 leak-0 Payload (extrait) GET /build/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: SearchExpress Accept-Charset: utf-8 Accept-Encoding: gzip Requête brute (extrait) GET /build/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: SearchExpress Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "0f34e46ee455e3902ab13bd0e9ef41f45fdb19f3", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "6aeebdefc1a7f3903e2f068a42149eb080915c7b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 150, "payload_entropy": 5.095868565039815, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 64, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "42774005597a725f8f48b6e696a30f905097a445", "event_fingerprint": "73241ece8127f3fc9dbb75bcd3a58c1f06faf17f", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "079271c120bdf55f3ee944ef880898e1", "payload_hash": "a823bcfe60999c93e0cf4b4c86c2a6f8", "path_pattern_hash": "203627ae3f02d834b42dc778d4676888" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r", "method": "GET", "path": "\/build\/.git\/config", "user_agent": "SearchExpress", "waf_tags": [ "950468:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "nosqli-3", "leak-0" ], "request_line": "GET \/build\/.git\/config HTTP\/1.1", "request_sample": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip", "evidence": { "method": "GET", "path": "\/build\/.git\/config", "user_agent": "SearchExpress", "waf_tags": [ "950468:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "nosqli-3", "leak-0" ], "request_line": "GET \/build\/.git\/config HTTP\/1.1", "request_sample": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1e3d4902b7f31d69caf0b86e2df89585e52f4524", "protocol_details": { "http_method": "GET", "http_path": "\/build\/.git\/config", "request_line": "GET \/build\/.git\/config HTTP\/1.1", "http_user_agent": "SearchExpress", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/build\/.git\/config", "request_line": "GET \/build\/.git\/config HTTP\/1.1", "http_user_agent": "SearchExpress", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/.git\/config", "evidence_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: SearchExpress\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /admin/.git/config	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /admin/.git/config UA Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /admin/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /admin/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 63 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /admin/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /admin/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT Requête brute (extrait) GET /admin/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "d8ca03afe0de0d3921ad8d2e8ce2ec1d93f0b43f", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "0d4fda54689ca91aa1cd9ce83cd7fe814ab26468", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 246, "payload_entropy": 5.426779434853514, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 10, "anomaly_count": 0, "campaign_key": "cd44a5d75a08bdf04b210cea412ffe5b38bb8749", "event_fingerprint": "c93cf9ba637fcdcb701b41a7be36f22806d0a647", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "34c18dff7b14b98593913d631bdcc638", "payload_hash": "d7b7fe3de3c79eb1adb463c982368e09", "path_pattern_hash": "b0ac58c50c927a70e841faaa3da36222" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHT", "method": "GET", "path": "\/admin\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/admin\/.git\/config HTTP\/1.1", "request_sample": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHT", "evidence": { "method": "GET", "path": "\/admin\/.git\/config", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/admin\/.git\/config HTTP\/1.1", "request_sample": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHT", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2ed53423c078e868956cffa11a62c4e02f1ed85", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/.git\/config", "request_line": "GET \/admin\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHT", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 63, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/.git\/config", "request_line": "GET \/admin\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.92 Safari\/537.36", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.git\/config", "evidence_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHT", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_admin_panel_probe", "http_admin_panel_scan", "http_backup_file_scan", "http_git_exposure", "http_probe_admin", "http_sensitive_path" ] }
14/06/2026 15:01:23 UTC	TCP	2525 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:2525 · (tentative d'exploit) · → /portal/.git/config	Élevée	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /portal/.git/config UA Mozilla/5.0 (X11; NetBSD amd64; rv:16.0) Gecko/20121102 Firefox… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /portal/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2525 Chemin / cible /portal/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 62 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /portal/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (X11; NetBSD amd64; rv:16.0) Gecko/20121102 Firefox/16.0 Règles WAF rce-0 nosqli-3 leak-0 Payload (extrait) GET /portal/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (X11; NetBSD amd64; rv:16.0) Gecko/20121102 Fir Requête brute (extrait) GET /portal/.git/config HTTP/1.1 Host: 62.3.50.33:2095 User-Agent: Mozilla/5.0 (X11; NetBSD amd64; rv:16.0) Gecko/20121102 Firefox/16.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "cad32438d9f872562221b666a42de5c08cdc0bec", "http_host_hash": "665b7879df24afb2c3e2f63a5d2838c6e6610357", "http_target_hash": "c6c2b01731ed2b569c9ab907e9a96206a2cfc6cc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 206, "payload_entropy": 5.322491015904738, "port_category": "registered", "org": "GOOGL-2", "service": "http", "app_proto": "http", "asn": null, "country": "unknown", "dst_port": 2525, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 62, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f6b5782fa310d1fe7b35987ccc3bc03c7ae416b3", "event_fingerprint": "d1b39568d5e23e2e29606c89201862aaca445a6f", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "unknown", "org": "GOOGL-2", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "65ab675a4c754c256b8b06ebdfde7492", "payload_hash": "a61fd82d10b8b74dd3364c9818e28817", "path_pattern_hash": "b68e69ddda3386f78de437bb71fa9236" }, "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Fir", "method": "GET", "path": "\/portal\/.git\/config", "user_agent": "Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/portal\/.git\/config HTTP\/1.1", "request_sample": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Fir", "evidence": { "method": "GET", "path": "\/portal\/.git\/config", "user_agent": "Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0" ], "request_line": "GET \/portal\/.git\/config HTTP\/1.1", "request_sample": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Fir", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5bcda023256eb299837d44fdce7520b882edd0e8", "protocol_details": { "http_method": "GET", "http_path": "\/portal\/.git\/config", "request_line": "GET \/portal\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Fir", "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.git\/config", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 62, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/portal\/.git\/config", "request_line": "GET \/portal\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Firefox\/16.0", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:2525 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.git\/config", "evidence_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2095\r\nUser-Agent: Mozilla\/5.0 (X11; NetBSD amd64; rv:16.0) Gecko\/20121102 Fir", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "http_backup_file_scan", "http_git_exposure", "http_sensitive_path" ] }

8.231.64.19

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence