|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c7b1eeedec99c921
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ������ ���̖�>_��aג���6 ��!t��� ���HIR���!�#�# ԓ�%���Zԝ� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������
���̖�>_��aג���6 ��!t��� ���HIR���!�#�# ԓ�%���Zԝ� �,�+̩�0�/̨ � �
Requête brute (extrait)
� ������ ���̖�>_��aג���6 ��!t��� ���HIR���!�#�# ԓ�%���Zԝ� �,�+̩�0�/̨ � � # 3 & $ ʲ� I8��mW�.˟�P��Z0 ��*L'L�~ - + http/1.1
Meta JSON brut
{
"tls_ja3_hash": "c7b1eeedec99c92118e0066c761afa96",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.893360519675388,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "0f7c1f597d8fe07f581a45460a860b3597f8ad60",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c7b1eeedec99c92118e0066c761afa96",
"payload_hash": "49378d576353f9006491d9254d883287",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "23b356e9b61f2bad3569820756d57ab2",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-10-23-11-35-51-45-43-13-16,29-23-24,0",
"tls_ja4_hash": "23b356e9b61f2bad3569820756d57ab2",
"tls_ja4": "t13d0110_aaede914b551_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010\u02b2\ufffd I8\u0002\ufffd\ufffdmW\ufffd.\u02df\ufffdP\ufffd\ufffdZ0\u0004\u001d\ufffd\ufffd*L'L\ufffd~\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1ef9f15be1b2a0d6ab8d694dadeef085e56c57f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "c7b1eeedec99c92118e0066c761afa96",
"tls_ja4": "23b356e9b61f2bad3569820756d57ab2",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "c7b1eeedec99c92118e0066c761afa96",
"tls_ja4": "23b356e9b61f2bad3569820756d57ab2",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u0316\ufffd>_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d7b4a6cd6a4fe04f
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ��u�_c� l��Vj�5�ҹQ�UL(F!Cg�" ��l%2M�����1���2S�t��L^ FX��� �,�+̩�0�/̨ � � http/1.1 - 3 &
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��u�_c� l��Vj�5�ҹQ�UL(F!Cg�" ��l%2M�����1���2S�t��L^ FX��� �,�+̩�0�/̨ � � http/1.1 - 3 &
Requête brute (extrait)
� ��u�_c� l��Vj�5�ҹQ�UL(F!Cg�" ��l%2M�����1���2S�t��L^ FX��� �,�+̩�0�/̨ � � http/1.1 - 3 & $ T�<P��;�/*:���U��.2aD~K&�Y�8 # +
Meta JSON brut
{
"tls_ja3_hash": "d7b4a6cd6a4fe04f4a61cc770420c799",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.898928688025557,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "0a3247f97d240565a37b1547d8b99a9149ba391a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d7b4a6cd6a4fe04f4a61cc770420c799",
"payload_hash": "2ab0c759bd7a21acb40132bb14e96abe",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "74d4035dbc86c8cbeeadb3acd72589a9",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-51-35-23-43-10-13-11-5,29-23-24,0",
"tls_ja4_hash": "74d4035dbc86c8cbeeadb3acd72589a9",
"tls_ja4": "t13d0110_bb90b10132d9_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014u\ufffd_c\ufffd\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\u0010Q\ufffd\u0007UL(\u000eF!Cg\ufffd\" \ufffd\ufffdl%2M\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\u001dFX\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014u\ufffd_c\ufffd\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\u0010Q\ufffd\u0007UL(\u000eF!Cg\ufffd\" \ufffd\ufffdl%2M\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\u001dFX\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 T\ufffd<P\ufffd\u0019\u0016\ufffd;\ufffd\/*:\ufffd\ufffd\u0007\ufffdU\ufffd\ufffd.2aD~K&\ufffdY\u0003\ufffd8\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014u\ufffd_c\ufffd\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\u0010Q\ufffd\u0007UL(\u000eF!Cg\ufffd\" \ufffd\ufffdl%2M\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\u001dFX\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7f4ad1aed4d41aa4f35d6a849e4a40166689055",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014u\ufffd_c\ufffd\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\u0010Q\ufffd\u0007UL(\u000eF!Cg\ufffd\" \ufffd\ufffdl%2M\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\u001dFX\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"tls_ja3": "d7b4a6cd6a4fe04f4a61cc770420c799",
"tls_ja4": "74d4035dbc86c8cbeeadb3acd72589a9",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdu\ufffd_c\ufffdl\ufffd\ufffdVj\ufffd5\ufffd\u04b9Q\ufffdUL(F!Cg\ufffd\" \ufffd\ufffdl%2M\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^FX\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-3&",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014u\ufffd_c\ufffd\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\u0010Q\ufffd\u0007UL(\u000eF!Cg\ufffd\" \ufffd\ufffdl%2M\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\u001dFX\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"tls_ja3": "d7b4a6cd6a4fe04f4a61cc770420c799",
"tls_ja4": "74d4035dbc86c8cbeeadb3acd72589a9",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdu\ufffd_c\ufffdl\ufffd\ufffdVj\ufffd5\ufffd\u04b9Q\ufffdUL(F!Cg\ufffd\" \ufffd\ufffdl%2M\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^FX\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-3&",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3d3289cfe0f042f3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ��;� a��C"����vU��AM?��n��Xg.FB L� Ք�6o�]+e|{�/0M:h�:[~��a �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��;� a��C"����vU��AM?��n��Xg.FB L� Ք�6o�]+e|{�/0M:h�:[~��a �,�+̩�0�/̨ � � #
Requête brute (extrait)
� ��;� a��C"����vU��AM?��n��Xg.FB L� Ք�6o�]+e|{�/0M:h�:[~��a �,�+̩�0�/̨ � � # 3 & $ 0��6��]%j(5 ��sT��ڝ� 6����o� + http/1.1 -
Meta JSON brut
{
"tls_ja3_hash": "3d3289cfe0f042f38f9537a93a0e0e26",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.941052480560553,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "582cfabf38b07b0411723434409bc8348ef1dada",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3d3289cfe0f042f38f9537a93a0e0e26",
"payload_hash": "f3726d1f28e4f1f0a836ba32d91c52a3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "1e54f80cbfc7f20a566f873fdeb32388",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-13-51-23-43-16-10-45-11-5,29-23-24,0",
"tls_ja4_hash": "1e54f80cbfc7f20a566f873fdeb32388",
"tls_ja4": "t13d0110_6cf419ae3aba_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\ufffd\u000ba\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\u0005\ufffd\ufffdXg.FB\u0002 L\ufffd\u001d\u0014\u0011\u0014\u0554\ufffd6o\ufffd]+e|{\u0015\ufffd\/0M:h\ufffd:\u0016[~\ufffd\ufffda\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\ufffd\u000ba\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\u0005\ufffd\ufffdXg.FB\u0002 L\ufffd\u001d\u0014\u0011\u0014\u0554\ufffd6o\ufffd]+e|{\u0015\ufffd\/0M:h\ufffd:\u0016[~\ufffd\ufffda\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 0\ufffd\ufffd6\ufffd\ufffd]%j(5\u001c\ufffd\ufffdsT\ufffd\ufffd\u069d\ufffd\r6\ufffd\ufffd\ufffd\ufffdo\ufffd\u0012\u001f\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\ufffd\u000ba\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\u0005\ufffd\ufffdXg.FB\u0002 L\ufffd\u001d\u0014\u0011\u0014\u0554\ufffd6o\ufffd]+e|{\u0015\ufffd\/0M:h\ufffd:\u0016[~\ufffd\ufffda\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f7f08c283855e22247bb864173957411318e639",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\ufffd\u000ba\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\u0005\ufffd\ufffdXg.FB\u0002 L\ufffd\u001d\u0014\u0011\u0014\u0554\ufffd6o\ufffd]+e|{\u0015\ufffd\/0M:h\ufffd:\u0016[~\ufffd\ufffda\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "3d3289cfe0f042f38f9537a93a0e0e26",
"tls_ja4": "1e54f80cbfc7f20a566f873fdeb32388",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffda\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\ufffd\ufffdXg.FB L\ufffd\u0554\ufffd6o\ufffd]+e|{\ufffd\/0M:h\ufffd:[~\ufffd\ufffda\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\ufffd\u000ba\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\u0005\ufffd\ufffdXg.FB\u0002 L\ufffd\u001d\u0014\u0011\u0014\u0554\ufffd6o\ufffd]+e|{\u0015\ufffd\/0M:h\ufffd:\u0016[~\ufffd\ufffda\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "3d3289cfe0f042f38f9537a93a0e0e26",
"tls_ja4": "1e54f80cbfc7f20a566f873fdeb32388",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffda\ufffd\ufffdC\"\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\ufffd\ufffdXg.FB L\ufffd\u0554\ufffd6o\ufffd]+e|{\ufffd\/0M:h\ufffd:[~\ufffd\ufffda\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 90e495c04fc027fe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �,>]��E�o+M� F�ǃ,&��ј�� WSqT$ �C��](N2m�Y�^Y: �#�IMg*����u� �,�+̩�0�/̨ � � 3 & $
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �,>]��E�o+M� F�ǃ,&��ј�� WSqT$ �C��](N2m�Y�^Y: �#�IMg*����u� �,�+̩�0�/̨ � � 3 & $
Requête brute (extrait)
� �,>]��E�o+M� F�ǃ,&��ј�� WSqT$ �C��](N2m�Y�^Y: �#�IMg*����u� �,�+̩�0�/̨ � � 3 & $ [vPQ��w�� _��h=� �͙�˞7`0�x # - + http/1.1
Meta JSON brut
{
"tls_ja3_hash": "90e495c04fc027fef8b01d4e78480e0e",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.821836985613132,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "bd867bb4214d90431c304b2e54a9da974dabfabc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "90e495c04fc027fef8b01d4e78480e0e",
"payload_hash": "ed306edc21356f0577a71e321189a9f1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "48de49af10969271bf8555ce7a69aece",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-11-51-10-35-23-45-43-13-16,29-23-24,0",
"tls_ja4_hash": "48de49af10969271bf8555ce7a69aece",
"tls_ja4": "t13d0110_20fd877c8fe1_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\u0013\ufffd\u0458\ufffd\ufffd\u0000WSqT$ \u0018\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\u0013\ufffd\u0458\ufffd\ufffd\u0000WSqT$ \u0018\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005[vPQ\ufffd\ufffdw\ufffd\ufffd\u001e_\ufffd\ufffdh=\ufffd\u001c\ufffd\u0359\ufffd\u02de\u0003\u00137`0\u0005\ufffdx\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\u0013\ufffd\u0458\ufffd\ufffd\u0000WSqT$ \u0018\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23277fabdf84d0ce34ace67ed63512b6ecc558b1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\u0013\ufffd\u0458\ufffd\ufffd\u0000WSqT$ \u0018\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005",
"tls_ja3": "90e495c04fc027fef8b01d4e78480e0e",
"tls_ja4": "48de49af10969271bf8555ce7a69aece",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\ufffd\u0458\ufffd\ufffdWSqT$ \ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIMg*\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\u0013\ufffd\u0458\ufffd\ufffd\u0000WSqT$ \u0018\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005",
"tls_ja3": "90e495c04fc027fef8b01d4e78480e0e",
"tls_ja4": "48de49af10969271bf8555ce7a69aece",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd,>]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,&\ufffd\ufffd\u0458\ufffd\ufffdWSqT$ \ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIMg*\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 777fdc20f1955c5f
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �Y�P:��(�ʛe�o�krp"���;C��(�l�� �F�0��m|?O� ���ǁ�z����c�2.� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Y�P:��(�ʛe�o�krp"���;C��(�l�� �F�0��m|?O� ���ǁ�z����c�2.� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �Y�P:��(�ʛe�o�krp"���;C��(�l�� �F�0��m|?O� ���ǁ�z����c�2.� �,�+̩�0�/̨ � � - 3 & $ e���}�D:<�f Ǘ���ϟCZ�� ��M http/1.1 # +
Meta JSON brut
{
"tls_ja3_hash": "777fdc20f1955c5fab8a7e65b28748d5",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.936984223335046,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "250f541b35c2d4b45386f3433f71d6f2ecac5717",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "777fdc20f1955c5fab8a7e65b28748d5",
"payload_hash": "e6ab2126c5483e7bf49e5da85cba6057",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "4755ce2356089d29694f1936b1e457a7",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-45-11-5-51-16-23-35-43-10,29-23-24,0",
"tls_ja4_hash": "4755ce2356089d29694f1936b1e457a7",
"tls_ja4": "t13d0110_15657a75ee0a_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\u0007o\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\u001a\ufffdl\ufffd\ufffd \u001a\ufffdF\ufffd0\ufffd\ufffdm\u0005|?O\ufffd\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\u001b\u0015c\ufffd2.\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\u0007o\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\u001a\ufffdl\ufffd\ufffd \u001a\ufffdF\ufffd0\ufffd\ufffdm\u0005|?O\ufffd\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\u001b\u0015c\ufffd2.\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 e\u0018\ufffd\ufffd\ufffd}\u0004\ufffdD:<\ufffdf\f\t\u01d7\ufffd\ufffd\ufffd\u03dfCZ\ufffd\u0019\ufffd\r\ufffd\ufffdM\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\u0007o\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\u001a\ufffdl\ufffd\ufffd \u001a\ufffdF\ufffd0\ufffd\ufffdm\u0005|?O\ufffd\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\u001b\u0015c\ufffd2.\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "01a1d4e920b0c5a88d16c1a31f21c1f818277b00",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\u0007o\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\u001a\ufffdl\ufffd\ufffd \u001a\ufffdF\ufffd0\ufffd\ufffdm\u0005|?O\ufffd\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\u001b\u0015c\ufffd2.\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "777fdc20f1955c5fab8a7e65b28748d5",
"tls_ja4": "4755ce2356089d29694f1936b1e457a7",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdY\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffdo\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\ufffdl\ufffd\ufffd \ufffdF\ufffd0\ufffd\ufffdm|?O\ufffd\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffdc\ufffd2.\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\u0007o\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\u001a\ufffdl\ufffd\ufffd \u001a\ufffdF\ufffd0\ufffd\ufffdm\u0005|?O\ufffd\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\u001b\u0015c\ufffd2.\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "777fdc20f1955c5fab8a7e65b28748d5",
"tls_ja4": "4755ce2356089d29694f1936b1e457a7",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdY\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffdo\ufffdkrp\"\ufffd\ufffd\ufffd;C\ufffd\ufffd(\ufffdl\ufffd\ufffd \ufffdF\ufffd0\ufffd\ufffdm|?O\ufffd\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffdc\ufffd2.\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7136c4053a2a86f6
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ���L�3��� ����-��gq���N_���v� f�:#�j�Ϯq�K��� 7C��n|�tq2\�� �,�+̩�0�/̨ � � http/1.1
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���L�3��� ����-��gq���N_���v� f�:#�j�Ϯq�K���
7C��n|�tq2\�� �,�+̩�0�/̨ � � http/1.1
Requête brute (extrait)
� ���L�3��� ����-��gq���N_���v� f�:#�j�Ϯq�K��� 7C��n|�tq2\�� �,�+̩�0�/̨ � � http/1.1 + # 3 & $ ��0&O��CW �!�� 7 {�Cv��P�} #o -
Meta JSON brut
{
"tls_ja3_hash": "7136c4053a2a86f6468f0e4ec0f89ff9",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.880938451377918,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "1b9ef73ed49add0198390a5a6018836fc5a0e4b1",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "7136c4053a2a86f6468f0e4ec0f89ff9",
"payload_hash": "fe8ca0473abba9474759e188c83ae30a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2df0774d9d1721764b57b99cabea3465",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-10-43-13-35-5-11-23-51-45,29-23-24,0",
"tls_ja4_hash": "2df0774d9d1721764b57b99cabea3465",
"tls_ja4": "t13d0110_01e84230edd0_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\bK\ufffd\ufffd\ufffd\n7C\u001b\ufffd\ufffdn|\ufffdtq2\u0011\\\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\bK\ufffd\ufffd\ufffd\n7C\u001b\ufffd\ufffdn|\ufffdtq2\u0011\\\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd0&O\u0011\ufffd\ufffdCW\u001c\ufffd!\ufffd\ufffd\r7\u001f{\ufffdCv\ufffd\ufffdP\u0012\ufffd}\r#o\u0017\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\bK\ufffd\ufffd\ufffd\n7C\u001b\ufffd\ufffdn|\ufffdtq2\u0011\\\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "11da69f8201dce3654381c350bbd8e22acdc6139",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\bK\ufffd\ufffd\ufffd\n7C\u001b\ufffd\ufffdn|\ufffdtq2\u0011\\\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000",
"tls_ja3": "7136c4053a2a86f6468f0e4ec0f89ff9",
"tls_ja4": "2df0774d9d1721764b57b99cabea3465",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd f\ufffd:#\ufffdj\ufffd\u03eeq\ufffdK\ufffd\ufffd\ufffd\n7C\ufffd\ufffdn|\ufffdtq2\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\bK\ufffd\ufffd\ufffd\n7C\u001b\ufffd\ufffdn|\ufffdtq2\u0011\\\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000",
"tls_ja3": "7136c4053a2a86f6468f0e4ec0f89ff9",
"tls_ja4": "2df0774d9d1721764b57b99cabea3465",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd f\ufffd:#\ufffdj\ufffd\u03eeq\ufffdK\ufffd\ufffd\ufffd\n7C\ufffd\ufffdn|\ufffdtq2\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 5c0d7e2d3ad7e864
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ��Q|[�&S � �S�ty��>ܗ�a�2� J̟[��U#x�X�|E䂌.� �-ǻo���Y: �,�+̩�0�/̨ � � # + http/1
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Q|[�&S � �S�ty��>ܗ�a�2�
J̟[��U#x�X�|E䂌.� �-ǻo���Y: �,�+̩�0�/̨ � � # + http/1
Requête brute (extrait)
� ��Q|[�&S � �S�ty��>ܗ�a�2� J̟[��U#x�X�|E䂌.� �-ǻo���Y: �,�+̩�0�/̨ � � # + http/1.1 3 & $ 0�b=A5��G�P@2��Z%8��s�U1k���y\ -
Meta JSON brut
{
"tls_ja3_hash": "5c0d7e2d3ad7e8642470d447279b1404",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.871990910972199,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "d7af63e319ceea25a1c885a0d43dbc9930e0aca0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "5c0d7e2d3ad7e8642470d447279b1404",
"payload_hash": "f2e15de98cbd4b1bfbda872f9030e876",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "632d8701e4d402a0190a39314478a5e6",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-43-16-11-51-23-10-13-5-45,29-23-24,0",
"tls_ja4_hash": "632d8701e4d402a0190a39314478a5e6",
"tls_ja4": "t13d0110_cf4435f47b4c_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ|[\ufffd&S\u000b\ufffd\u001e\ufffdS\ufffd\u0005t\u0015y\ufffd\ufffd\b>\u0717\ufffda\u000e\ufffd\u00122\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\b\ufffdY\u001b:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ|[\ufffd&S\u000b\ufffd\u001e\ufffdS\ufffd\u0005t\u0015y\ufffd\ufffd\b>\u0717\ufffda\u000e\ufffd\u00122\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\b\ufffdY\u001b:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 0\ufffd\u000fb=\bA5\ufffd\ufffdG\ufffdP@2\ufffd\ufffdZ%8\ufffd\ufffds\ufffdU1k\ufffd\ufffd\ufffdy\\\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ|[\ufffd&S\u000b\ufffd\u001e\ufffdS\ufffd\u0005t\u0015y\ufffd\ufffd\b>\u0717\ufffda\u000e\ufffd\u00122\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\b\ufffdY\u001b:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "400329ee4415de94d52ffc7e6717ca478d64c9a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ|[\ufffd&S\u000b\ufffd\u001e\ufffdS\ufffd\u0005t\u0015y\ufffd\ufffd\b>\u0717\ufffda\u000e\ufffd\u00122\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\b\ufffdY\u001b:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1",
"tls_ja3": "5c0d7e2d3ad7e8642470d447279b1404",
"tls_ja4": "632d8701e4d402a0190a39314478a5e6",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdQ|[\ufffd&S\ufffd\ufffdS\ufffdty\ufffd\ufffd>\u0717\ufffda\ufffd2\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\ufffdY:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\thttp\/1",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ|[\ufffd&S\u000b\ufffd\u001e\ufffdS\ufffd\u0005t\u0015y\ufffd\ufffd\b>\u0717\ufffda\u000e\ufffd\u00122\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\b\ufffdY\u001b:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1",
"tls_ja3": "5c0d7e2d3ad7e8642470d447279b1404",
"tls_ja4": "632d8701e4d402a0190a39314478a5e6",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdQ|[\ufffd&S\ufffd\ufffdS\ufffdty\ufffd\ufffd>\u0717\ufffda\ufffd2\ufffd\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\t\ufffd-\u01fbo\ufffd\ufffd\ufffdY:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\thttp\/1",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 40113921b6bb0dc6
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ��e��|.�֜����c���N���x��E�ev� 3(R )��zA������ �����joå �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��e��|.�֜����c���N���x��E�ev� 3(R )��zA������ �����joå �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��e��|.�֜����c���N���x��E�ev� 3(R )��zA������ �����joå �,�+̩�0�/̨ � � http/1.1 3 & $ �"�k�T��F��RC�zٗ���� BfR - # +
Meta JSON brut
{
"tls_ja3_hash": "40113921b6bb0dc690e70f296904af56",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.903672564277296,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "24ad1cb3f4ab4f1448f356ae4f698e23ea90ec2e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "40113921b6bb0dc690e70f296904af56",
"payload_hash": "3f8ae23e85b0d3889b15637211243d65",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "f08c08f57173af7730b1407a5d01dc32",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-16-51-45-23-10-11-35-43,29-23-24,0",
"tls_ja4_hash": "f08c08f57173af7730b1407a5d01dc32",
"tls_ja4": "t13d0110_202eb474adf0_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffd\ufffd\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\b \f3(R\u0002\u001d)\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd \ufffd\u0016\ufffd\ufffd\ufffd\u0018\ufffdjo\u00e5\u0000\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffd\ufffd\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\b \f3(R\u0002\u001d)\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd \ufffd\u0016\ufffd\ufffd\ufffd\u0018\ufffdjo\u00e5\u0000\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\"\ufffdk\ufffdT\ufffd\u0012\u0012\ufffd\ud8ce\udc91F\ufffd\ufffdRC\ufffdz\u0657\ufffd\ufffd\u0012\ufffd\ufffd\fBfR\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffd\ufffd\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\b \f3(R\u0002\u001d)\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd \ufffd\u0016\ufffd\ufffd\ufffd\u0018\ufffdjo\u00e5\u0000\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20dc0c09a82deee0b1984f4f8e0f7feaa6570446",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffd\ufffd\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\b \f3(R\u0002\u001d)\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd \ufffd\u0016\ufffd\ufffd\ufffd\u0018\ufffdjo\u00e5\u0000\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "40113921b6bb0dc690e70f296904af56",
"tls_ja4": "f08c08f57173af7730b1407a5d01dc32",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffde\ufffd\ufffd|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd 3(R)\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdjo\u00e5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffd\ufffd\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\b \f3(R\u0002\u001d)\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd \ufffd\u0016\ufffd\ufffd\ufffd\u0018\ufffdjo\u00e5\u0000\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "40113921b6bb0dc690e70f296904af56",
"tls_ja4": "f08c08f57173af7730b1407a5d01dc32",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffde\ufffd\ufffd|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd 3(R)\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdjo\u00e5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 18dcfeb13302991a
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ��@�pL�ӗ�H�� ���J��8m���>�%�� |� ��埼�4$�+B�� �~��YG�� � �,�+̩�0�/̨ � � + #
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��@�pL�ӗ�H�� ���J��8m���>�%�� |� ��埼�4$�+B�� �~��YG�� � �,�+̩�0�/̨ � � + #
Requête brute (extrait)
� ��@�pL�ӗ�H�� ���J��8m���>�%�� |� ��埼�4$�+B�� �~��YG�� � �,�+̩�0�/̨ � � + # - http/1.1 3 & $ [(Չ!��Db���ʭ:��ʖ�ke�Ia�1
Meta JSON brut
{
"tls_ja3_hash": "18dcfeb13302991a45dc516ee06d2dc8",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.860828464861142,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "80379c67d00d9ae0061dce8c5d26eb6c66dd530a",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "18dcfeb13302991a45dc516ee06d2dc8",
"payload_hash": "ca5310d13e28324d563e84f331fc71fd",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e20aeb209eb2c15e65f0859635eb96c0",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-35-5-10-13-45-16-11-51,29-23-24,0",
"tls_ja4_hash": "e20aeb209eb2c15e65f0859635eb96c0",
"tls_ja4": "t13d0110_2b93868a6c44_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\u0014H\ufffd\ufffd\u0000\ufffd\ufffd\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\u0019\ufffd\ufffd |\ufffd\u001d\ufffd\ufffd\u57fc\ufffd4\u0002$\ufffd\u0016+B\ufffd\ufffd\t\ufffd\u000e~\ufffd\ufffdYG\ufffd\ufffd\u001c\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\u0014H\ufffd\ufffd\u0000\ufffd\ufffd\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\u0019\ufffd\ufffd |\ufffd\u001d\ufffd\ufffd\u57fc\ufffd4\u0002$\ufffd\u0016+B\ufffd\ufffd\t\ufffd\u000e~\ufffd\ufffdYG\ufffd\ufffd\u001c\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 [(\u0010\u0549!\u0004\ufffd\ufffd\u0013Db\ufffd\ufffd\ufffd\u02ad:\ufffd\ufffd\u0015\u0296\ufffdke\ufffdIa\ufffd\u00131",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\u0014H\ufffd\ufffd\u0000\ufffd\ufffd\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\u0019\ufffd\ufffd |\ufffd\u001d\ufffd\ufffd\u57fc\ufffd4\u0002$\ufffd\u0016+B\ufffd\ufffd\t\ufffd\u000e~\ufffd\ufffdYG\ufffd\ufffd\u001c\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bdd23d37abf1201016c134142e71e968894883fa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\u0014H\ufffd\ufffd\u0000\ufffd\ufffd\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\u0019\ufffd\ufffd |\ufffd\u001d\ufffd\ufffd\u57fc\ufffd4\u0002$\ufffd\u0016+B\ufffd\ufffd\t\ufffd\u000e~\ufffd\ufffdYG\ufffd\ufffd\u001c\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"tls_ja3": "18dcfeb13302991a45dc516ee06d2dc8",
"tls_ja4": "e20aeb209eb2c15e65f0859635eb96c0",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd@\ufffdpL\ufffd\u04d7\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\ufffd\ufffd |\ufffd\ufffd\ufffd\u57fc\ufffd4$\ufffd+B\ufffd\ufffd\t\ufffd~\ufffd\ufffdYG\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\u0014H\ufffd\ufffd\u0000\ufffd\ufffd\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\u0019\ufffd\ufffd |\ufffd\u001d\ufffd\ufffd\u57fc\ufffd4\u0002$\ufffd\u0016+B\ufffd\ufffd\t\ufffd\u000e~\ufffd\ufffdYG\ufffd\ufffd\u001c\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"tls_ja3": "18dcfeb13302991a45dc516ee06d2dc8",
"tls_ja4": "e20aeb209eb2c15e65f0859635eb96c0",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd@\ufffdpL\ufffd\u04d7\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd>\ufffd%\ufffd\ufffd |\ufffd\ufffd\ufffd\u57fc\ufffd4$\ufffd+B\ufffd\ufffd\t\ufffd~\ufffd\ufffdYG\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 f4bf45df97e20693
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� � @E��*sK �O^qw�2��,�oa����.�� �� �0�?�4uc��+X+�� kc��㏃N�=� �,�+̩�0�/̨ � � http/1.1 3 & $ �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � @E��*sK �O^qw�2��,�oa����.�� ��
�0�?�4uc��+X+�� kc��㏃N�=� �,�+̩�0�/̨ � � http/1.1 3 & $ �
Requête brute (extrait)
� � @E��*sK �O^qw�2��,�oa����.�� �� �0�?�4uc��+X+�� kc��㏃N�=� �,�+̩�0�/̨ � � http/1.1 3 & $ �`����� �?�� �@ܮީ4[JK���Ǟk + # -
Meta JSON brut
{
"tls_ja3_hash": "f4bf45df97e206939127b7235ffb27d5",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.916552861411075,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "bd250760ee1413f919e8fc7a9ee1fa6c08fe549e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f4bf45df97e206939127b7235ffb27d5",
"payload_hash": "996ec3a0d60826c18dfa0865828a4889",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "8e2ee13d8314f642c6813b617dd693ba",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-51-43-11-35-45-23-5-13-10,29-23-24,0",
"tls_ja4_hash": "8e2ee13d8314f642c6813b617dd693ba",
"tls_ja4": "t13d0110_41138e76bbe6_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t@\u0015E\ufffd\ufffd*sK\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\u0019\ufffd\u33c3N\ufffd=\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t@\u0015E\ufffd\ufffd*sK\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\u0019\ufffd\u33c3N\ufffd=\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd`\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\u001d\ufffd?\u0003\ufffd\ufffd\u001a\u001d\ufffd@\u072e\u07a94[JK\ufffd\ufffd\ufffd\u01dek\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t@\u0015E\ufffd\ufffd*sK\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\u0019\ufffd\u33c3N\ufffd=\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af0d5915cd7c867839a17214fd3b31dc59df61b4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t@\u0015E\ufffd\ufffd*sK\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\u0019\ufffd\u33c3N\ufffd=\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"tls_ja3": "f4bf45df97e206939127b7235ffb27d5",
"tls_ja4": "8e2ee13d8314f642c6813b617dd693ba",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\t@E\ufffd\ufffd*sK\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdoa\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\ufffd\u33c3N\ufffd=\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.13&$ \ufffd",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t@\u0015E\ufffd\ufffd*sK\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\u0019\ufffd\u33c3N\ufffd=\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"tls_ja3": "f4bf45df97e206939127b7235ffb27d5",
"tls_ja4": "8e2ee13d8314f642c6813b617dd693ba",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\t@E\ufffd\ufffd*sK\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdoa\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\tkc\ufffd\ufffd\u33c3N\ufffd=\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.13&$ \ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8294a5c8c46c50e3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� ������b���(�AH��s�J�^ �CFa�NZQ �_.�O��5��ib,� Sz�������a@ U�Y �,�+̩�0�/̨ � � http/1.1
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������b���(�AH��s�J�^ �CFa�NZQ �_.�O��5��ib,� Sz�������a@ U�Y �,�+̩�0�/̨ � � http/1.1
Requête brute (extrait)
� ������b���(�AH��s�J�^ �CFa�NZQ �_.�O��5��ib,� Sz�������a@ U�Y �,�+̩�0�/̨ � � http/1.1 # - + 3 & $ �D��}cr��9���C�ͷs韧.�y�� �p
Meta JSON brut
{
"tls_ja3_hash": "8294a5c8c46c50e3ba801da667fd69f9",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.929475654905472,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "9f89ad3bc41036a091d996a0a642d9b04786f194",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8294a5c8c46c50e3ba801da667fd69f9",
"payload_hash": "d7a221c06e4996b6164b702278a12147",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "dfe1d4e237dae527117ecea9b25bed56",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-23-10-35-5-13-45-11-43-51,29-23-24,0",
"tls_ja4_hash": "dfe1d4e237dae527117ecea9b25bed56",
"tls_ja4": "t13d0110_1bcad088a963_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\u0000\ufffdCFa\u000f\ufffd\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\u000e\ufffd\ufffdib,\ufffd S\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\u001fU\ufffdY\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\u0000\ufffdCFa\u000f\ufffd\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\u000e\ufffd\ufffdib,\ufffd S\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\u001fU\ufffdY\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdD\ufffd\ufffd}cr\ufffd\ufffd9\ufffd\ufffd\ufffdC\ufffd\u0006\u0377s\u0013\u97e7.\ufffdy\ufffd\ufffd\u001e\ufffdp",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\u0000\ufffdCFa\u000f\ufffd\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\u000e\ufffd\ufffdib,\ufffd S\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\u001fU\ufffdY\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d9ee27a966d3aacc08858b6964d9a1322e775da",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\u0000\ufffdCFa\u000f\ufffd\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\u000e\ufffd\ufffdib,\ufffd S\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\u001fU\ufffdY\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "8294a5c8c46c50e3ba801da667fd69f9",
"tls_ja4": "dfe1d4e237dae527117ecea9b25bed56",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\ufffdCFa\ufffdNZQ \ufffd_.\ufffdO\ufffd\ufffd5\ufffd\ufffdib,\ufffd Sz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@U\ufffdY\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\u0000\ufffdCFa\u000f\ufffd\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\u000e\ufffd\ufffdib,\ufffd S\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\u001fU\ufffdY\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "8294a5c8c46c50e3ba801da667fd69f9",
"tls_ja4": "dfe1d4e237dae527117ecea9b25bed56",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\ufffdCFa\ufffdNZQ \ufffd_.\ufffdO\ufffd\ufffd5\ufffd\ufffdib,\ufffd Sz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@U\ufffdY\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 e540e45014e164b7
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �C�, 6L� y��L��TQ� � ��,�=k�N���& �/?a�*���qp�ǾY�>]�|�*���t{��( �,�+̩�0�/̨ � � 3 & $ (�d㍝��x��B�
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �C�,
6L� y��L��TQ� � ��,�=k�N���& �/?a�*���qp�ǾY�>]�|�*���t{��( �,�+̩�0�/̨ � � 3 & $ (�d㍝��x��B�
Requête brute (extrait)
� �C�, 6L� y��L��TQ� � ��,�=k�N���& �/?a�*���qp�ǾY�>]�|�*���t{��( �,�+̩�0�/̨ � � 3 & $ (�d㍝��x��B���c ���?r|�F� http/1.1 + - #
Meta JSON brut
{
"tls_ja3_hash": "e540e45014e164b723be0b3296f977c4",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.887724642346384,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "bf626db030a2f7655250243adb1ff833f024a95c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "e540e45014e164b723be0b3296f977c4",
"payload_hash": "90169fb523d826a33612758cc6421e9f",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "9b5b2b90797f82e90c97a0d2f14d15e9",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-10-16-43-5-45-11-35-13,29-23-24,0",
"tls_ja4_hash": "9b5b2b90797f82e90c97a0d2f14d15e9",
"tls_ja4": "t13d0110_ef7666199055_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\f\ufffd\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd\u0010\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 (\ufffd\u0014\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\f\ufffd\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd\u0010\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 (\ufffd\u0014\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\ufffd\ufffdc\r\u001a\ufffd\ufffd\u0016\ufffd?r|\ufffdF\ufffd\b\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\f\ufffd\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd\u0010\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 (\ufffd\u0014\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d509d2969f90861de93366df0fc4176bb46bf9e5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\f\ufffd\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd\u0010\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 (\ufffd\u0014\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"tls_ja3": "e540e45014e164b723be0b3296f977c4",
"tls_ja4": "9b5b2b90797f82e90c97a0d2f14d15e9",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdC\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\ufffd\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ (\ufffdd\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\f\ufffd\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd\u0010\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 (\ufffd\u0014\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"tls_ja3": "e540e45014e164b723be0b3296f977c4",
"tls_ja4": "9b5b2b90797f82e90c97a0d2f14d15e9",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdC\ufffd,\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\ufffd\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd& \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd>]\ufffd|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ (\ufffdd\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 656a83c1a55ca147
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �j���gK�x�ֺ�ſũ� 4��U���e� ��� +�\=L��� g: ��?�� �ʺF`� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �j���gK�x�ֺ�ſũ�
4��U���e� ��� +�\=L��� g: ��?��
�ʺF`� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �j���gK�x�ֺ�ſũ� 4��U���e� ��� +�\=L��� g: ��?�� �ʺF`� �,�+̩�0�/̨ � � + 3 & $ �P��T�0pJ@�����q�3Q�;|��9�H%�+, http/1.1 - #
Meta JSON brut
{
"tls_ja3_hash": "656a83c1a55ca1475636ccc5e915663e",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.86295839258719,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "9254986911697537b8ee2eeb826891d8b86b1a96",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "656a83c1a55ca1475636ccc5e915663e",
"payload_hash": "1fbb14b492b10d4d83dd4d2ae158629d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "83e809460eabc262c3a9472eadb9f5ee",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-43-51-16-5-45-35-11-10,29-23-24,0",
"tls_ja4_hash": "83e809460eabc262c3a9472eadb9f5ee",
"tls_ja4": "t13d0110_7451c76761aa_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd\u001b\ufffd\ufffd\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffd\u0005U\ufffd\ufffd\ufffd\u0011e\ufffd \ufffd\ufffd\ufffd\f+\ufffd\\=L\ufffd\ufffd\u000e\ufffd\u0000g:\u001e\ufffd\ufffd?\ufffd\ufffd\u0010\u0013\n\ufffd\u0017\u02baF`\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd\u001b\ufffd\ufffd\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffd\u0005U\ufffd\ufffd\ufffd\u0011e\ufffd \ufffd\ufffd\ufffd\f+\ufffd\\=L\ufffd\ufffd\u000e\ufffd\u0000g:\u001e\ufffd\ufffd?\ufffd\ufffd\u0010\u0013\n\ufffd\u0017\u02baF`\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdP\ufffd\u0018\ufffdT\ufffd0pJ@\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd3Q\ufffd;|\ufffd\ufffd9\ufffdH%\ufffd+,\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd\u001b\ufffd\ufffd\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffd\u0005U\ufffd\ufffd\ufffd\u0011e\ufffd \ufffd\ufffd\ufffd\f+\ufffd\\=L\ufffd\ufffd\u000e\ufffd\u0000g:\u001e\ufffd\ufffd?\ufffd\ufffd\u0010\u0013\n\ufffd\u0017\u02baF`\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3617c5e3ed95525d0a5a03afd3c384ca11651b87",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd\u001b\ufffd\ufffd\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffd\u0005U\ufffd\ufffd\ufffd\u0011e\ufffd \ufffd\ufffd\ufffd\f+\ufffd\\=L\ufffd\ufffd\u000e\ufffd\u0000g:\u001e\ufffd\ufffd?\ufffd\ufffd\u0010\u0013\n\ufffd\u0017\u02baF`\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "656a83c1a55ca1475636ccc5e915663e",
"tls_ja4": "83e809460eabc262c3a9472eadb9f5ee",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdj\ufffd\ufffd\ufffdgK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffdU\ufffd\ufffd\ufffde\ufffd \ufffd\ufffd\ufffd+\ufffd\\=L\ufffd\ufffd\ufffdg:\ufffd\ufffd?\ufffd\ufffd\n\ufffd\u02baF`\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd\u001b\ufffd\ufffd\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffd\u0005U\ufffd\ufffd\ufffd\u0011e\ufffd \ufffd\ufffd\ufffd\f+\ufffd\\=L\ufffd\ufffd\u000e\ufffd\u0000g:\u001e\ufffd\ufffd?\ufffd\ufffd\u0010\u0013\n\ufffd\u0017\u02baF`\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "656a83c1a55ca1475636ccc5e915663e",
"tls_ja4": "83e809460eabc262c3a9472eadb9f5ee",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdj\ufffd\ufffd\ufffdgK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\r4\ufffd\ufffdU\ufffd\ufffd\ufffde\ufffd \ufffd\ufffd\ufffd+\ufffd\\=L\ufffd\ufffd\ufffdg:\ufffd\ufffd?\ufffd\ufffd\n\ufffd\u02baF`\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 93c5570fd016de4e
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �^I�> kf�� n5K���iZg�h��;m �p� Q5ճx�6w�����ت�+����i�ٷ�6�% �,�+̩�0�/̨ � � http/1.1 - +
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �^I�> kf�� n5K���iZg�h��;m �p� Q5ճx�6w�����ت�+����i�ٷ�6�% �,�+̩�0�/̨ � � http/1.1 - +
Requête brute (extrait)
� �^I�> kf�� n5K���iZg�h��;m �p� Q5ճx�6w�����ت�+����i�ٷ�6�% �,�+̩�0�/̨ � � http/1.1 - + 3 & $ ��^�E�K&d�ފ�aZ�Шn�=�d����1 #
Meta JSON brut
{
"tls_ja3_hash": "93c5570fd016de4edc4b2f3c55bffafc",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.937157849807936,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "c23d7a9fcb354521bb1090aff5584aa405a35be0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "93c5570fd016de4edc4b2f3c55bffafc",
"payload_hash": "a8951d6dafd20fa8dc6b86c55e303ecc",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "4e1ad00ab17b7265b6b8fb2d3344bedc",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-43-51-13-35-11-5-10-23,29-23-24,0",
"tls_ja4_hash": "4e1ad00ab17b7265b6b8fb2d3344bedc",
"tls_ja4": "t13d0110_3f647bab2205_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^I\ufffd>\u001ckf\ufffd\ufffd\fn5\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\u0011;m\u001d\ufffdp\ufffd Q5\u0573\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\u0014\ufffd6\ufffd%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^I\ufffd>\u001ckf\ufffd\ufffd\fn5\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\u0011;m\u001d\ufffdp\ufffd Q5\u0573\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\u0014\ufffd6\ufffd%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000e\ufffd^\ufffd\u0011E\ufffdK&d\ufffd\u078a\ufffdaZ\ufffd\u0428n\u0012\ufffd=\ufffdd\ufffd\ufffd\ufffd\ufffd1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^I\ufffd>\u001ckf\ufffd\ufffd\fn5\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\u0011;m\u001d\ufffdp\ufffd Q5\u0573\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\u0014\ufffd6\ufffd%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b82b15c6a61a69ba76f26d2af2d626f2b9bc71b2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^I\ufffd>\u001ckf\ufffd\ufffd\fn5\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\u0011;m\u001d\ufffdp\ufffd Q5\u0573\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\u0014\ufffd6\ufffd%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004",
"tls_ja3": "93c5570fd016de4edc4b2f3c55bffafc",
"tls_ja4": "4e1ad00ab17b7265b6b8fb2d3344bedc",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd^I\ufffd>kf\ufffd\ufffdn5K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd;m\ufffdp\ufffd Q5\u0573x\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\ufffd6\ufffd%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-+",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^I\ufffd>\u001ckf\ufffd\ufffd\fn5\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\u0011;m\u001d\ufffdp\ufffd Q5\u0573\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\u0014\ufffd6\ufffd%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004",
"tls_ja3": "93c5570fd016de4edc4b2f3c55bffafc",
"tls_ja4": "4e1ad00ab17b7265b6b8fb2d3344bedc",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd^I\ufffd>kf\ufffd\ufffdn5K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd;m\ufffdp\ufffd Q5\u0573x\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\ufffd6\ufffd%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-+",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8d7f5105763980c7
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �X��Q�lP��rZ�M����ׁÅu~ٚoSsn �� v&��\<�����<�rt� �r�%��h�. �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �X��Q�lP��rZ�M����ׁÅu~ٚoSsn �� v&��\<�����<�rt� �r�%��h�. �,�+̩�0�/̨ � �
Requête brute (extrait)
� �X��Q�lP��rZ�M����ׁÅu~ٚoSsn �� v&��\<�����<�rt� �r�%��h�. �,�+̩�0�/̨ � � http/1.1 # - 3 & $ ���2Q�/�~���k2)(t�hҙ ;��( +
Meta JSON brut
{
"tls_ja3_hash": "8d7f5105763980c7c02cb8016661413e",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.8104593134610685,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "cfbe7357a4a85f0a0e74606d268681d244faa514",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8d7f5105763980c7c02cb8016661413e",
"payload_hash": "f88a90972ac6c5d116fe4b47bdfafd13",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "52c26397461af68e8237e896b95fd3b2",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-23-5-16-11-35-10-45-51-43,29-23-24,0",
"tls_ja4_hash": "52c26397461af68e8237e896b95fd3b2",
"tls_ja4": "t13d0110_ddc6fb169c15_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\u0014Z\ufffdM\ufffd\ufffd\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \u001d\ufffd\ufffd\u001e\u001cv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd\b<\ufffdrt\ufffd\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\u0014Z\ufffdM\ufffd\ufffd\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \u001d\ufffd\ufffd\u001e\u001cv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd\b<\ufffdrt\ufffd\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0012\ufffd2\u0014Q\ufffd\/\ufffd~\ufffd\u0017\ufffd\ufffdk\u00122)(t\ufffdh\u0499\u0011\u001e;\ufffd\ufffd(\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\u0014Z\ufffdM\ufffd\ufffd\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \u001d\ufffd\ufffd\u001e\u001cv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd\b<\ufffdrt\ufffd\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d56ba517b85f6f4cb527fa5ea1cbdf064eae7651",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\u0014Z\ufffdM\ufffd\ufffd\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \u001d\ufffd\ufffd\u001e\u001cv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd\b<\ufffdrt\ufffd\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "8d7f5105763980c7c02cb8016661413e",
"tls_ja4": "52c26397461af68e8237e896b95fd3b2",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdX\ufffd\ufffdQ\ufffdlP\ufffd\ufffdrZ\ufffdM\ufffd\ufffd\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \ufffd\ufffdv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdrt\ufffd\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\u0014Z\ufffdM\ufffd\ufffd\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \u001d\ufffd\ufffd\u001e\u001cv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd\b<\ufffdrt\ufffd\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "8d7f5105763980c7c02cb8016661413e",
"tls_ja4": "52c26397461af68e8237e896b95fd3b2",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdX\ufffd\ufffdQ\ufffdlP\ufffd\ufffdrZ\ufffdM\ufffd\ufffd\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \ufffd\ufffdv&\ufffd\ufffd\\<\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdrt\ufffd\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4ade16480b6c2a06
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �إ�y ����a%�}������uL��d���"�� %%,���o~��"�7I;����&�����e��� �,�+̩�0�/̨ � � - +
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �إ�y
����a%�}������uL��d���"�� %%,���o~��"�7I;����&�����e��� �,�+̩�0�/̨ � � - +
Requête brute (extrait)
� �إ�y ����a%�}������uL��d���"�� %%,���o~��"�7I;����&�����e��� �,�+̩�0�/̨ � � - + 3 & $ %�e9�� ��X.��C�ۨ��kHMxo�w��%f # http/1.1
Meta JSON brut
{
"tls_ja3_hash": "4ade16480b6c2a0605213c7d41a240e6",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.926932150858933,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "769eaa857cab790aee1ba065b3c0c45a379b4c21",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4ade16480b6c2a0605213c7d41a240e6",
"payload_hash": "79fab4b59b39d9057260d542789e6967",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "00af2f490dcc72958432b14c3fa39e01",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-5-43-51-10-35-16-23-13,29-23-24,0",
"tls_ja4_hash": "00af2f490dcc72958432b14c3fa39e01",
"tls_ja4": "t13d0110_f0f1607e3479_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\u0013e\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\u0013e\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 %\ufffde9\ufffd\ufffd\u001e\ufffd\ufffdX.\ufffd\ufffdC\u0019\ufffd\u06e8\ufffd\ufffdkHMxo\ufffdw\ufffd\ufffd%f\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\u0013e\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de0c05ee09c56c0895f49588ef8ef2f2ea99cf52",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\u0013e\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004",
"tls_ja3": "4ade16480b6c2a0605213c7d41a240e6",
"tls_ja4": "00af2f490dcc72958432b14c3fa39e01",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\u0013e\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004",
"tls_ja3": "4ade16480b6c2a0605213c7d41a240e6",
"tls_ja4": "00af2f490dcc72958432b14c3fa39e01",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0625\ufffdy\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\"\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\"\ufffd7I;\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
264 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:264 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 32c9669e7f9488c6
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
264
Chemin / cible
—
Service
TLS
Payload
� �U�}��W�E����=�X�l �Vv5� �U�0�4� \�ܹ�\P&����Zl�U�1*O�adX�{ �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �U�}��W�E����=�X�l �Vv5�
�U�0�4�
\�ܹ�\P&����Zl�U�1*O�adX�{ �,�+̩�0�/̨ � �
Requête brute (extrait)
� �U�}��W�E����=�X�l �Vv5� �U�0�4� \�ܹ�\P&����Zl�U�1*O�adX�{ �,�+̩�0�/̨ � � # - + http/1.1 3 & $ X��f���,�m��� w�ҫ�Te���>p
Meta JSON brut
{
"tls_ja3_hash": "32c9669e7f9488c6ae32a8e319c0e20a",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.896600017812844,
"port_category": "well_known",
"org": "OVH SAS",
"service": "tls",
"app_proto": "tls",
"asn": 16276,
"country": "RU",
"dst_port": 264,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "235802f0b488a3ab8044b85cbfa142ee014e90fd",
"event_fingerprint": "498ee9272236d3ddb61cbaf0d7b4cfaf7c709b8d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "32c9669e7f9488c6ae32a8e319c0e20a",
"payload_hash": "a9e18534fb28e2d42b6ee5496c49cc86",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "357dc91453e80b2fd855261b5fa5dd58",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-5-13-11-35-45-43-16-23-51,29-23-24,0",
"tls_ja4_hash": "357dc91453e80b2fd855261b5fa5dd58",
"tls_ja4": "t13d0110_35e13812ab09_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 264,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\f\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\u0015\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZ\u001bl\ufffdU\ufffd1*O\u0012\u0010\ufffdadX\ufffd{\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\f\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\u0015\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZ\u001bl\ufffdU\ufffd1*O\u0012\u0010\ufffdadX\ufffd{\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 X\ufffd\ufffdf\ufffd\ufffd\ufffd,\ufffdm\ufffd\ufffd\ufffd\u05c8\fw\ufffd\u04ab\ufffdTe\ufffd\u0010\ufffd\ufffd>\u0007p",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\f\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\u0015\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZ\u001bl\ufffdU\ufffd1*O\u0012\u0010\ufffdadX\ufffd{\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "183524523679ee4656b9bc4b11b8eb2e88dfd1b3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\f\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\u0015\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZ\u001bl\ufffdU\ufffd1*O\u0012\u0010\ufffdadX\ufffd{\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000",
"tls_ja3": "32c9669e7f9488c6ae32a8e319c0e20a",
"tls_ja4": "357dc91453e80b2fd855261b5fa5dd58",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdU\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZl\ufffdU\ufffd1*O\ufffdadX\ufffd{\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 264,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\f\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\u0015\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZ\u001bl\ufffdU\ufffd1*O\u0012\u0010\ufffdadX\ufffd{\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000",
"tls_ja3": "32c9669e7f9488c6ae32a8e319c0e20a",
"tls_ja4": "357dc91453e80b2fd855261b5fa5dd58",
"port": 264,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdU\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\ufffdVv5\ufffd\r\ufffdU\ufffd0\ufffd4\ufffd \n\\\ufffd\u0739\ufffd\\P&\ufffd\ufffd\ufffd\ufffdZl\ufffdU\ufffd1*O\ufffdadX\ufffd{\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "264 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "264"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|