Renseignement sur les menaces

Roumanie

80.94.92.13

FAI Unmanaged Ltd Première vue 26/07/2026 19:03 UTC Dernière vue 26/07/2026 20:36 UTC Risque Moyen

Période analysée : 2026-04-30 → 2026-07-29

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP ALT 8087 — multi-protocole (148 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 55/100 Moyen

Première observation 26/07/2026 19:03 UTC

Dernière observation 26/07/2026 20:36 UTC

Événements (période) 957

MITRE ATT&CK principal T1046 933 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP ALT 8087 — multi-protocole (148 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Comparaison ASN / FAI

ASN 47890 · 80.94.92.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 957 événements sur la période pour cette IP.

193.32.162.34 Sonde SSH 29/07/2026 05:53 UTC
92.118.39.14 Sonde SSH 29/07/2026 04:20 UTC
92.118.39.77 Sonde SSH 29/07/2026 02:50 UTC
2.57.122.238 Sonde SSH 28/07/2026 16:20 UTC
92.118.39.50 Sonde SSH 28/07/2026 16:19 UTC
2.57.122.103 Sonde port 28/07/2026 04:42 UTC
92.118.39.49 Sonde SSH 27/07/2026 23:50 UTC
80.94.92.234 Sonde port 22/TCP 27/07/2026 16:14 UTC

Événements (filtres)

957

Première observation

26/07/2026 19:03 UTC

Dernière observation

26/07/2026 20:36 UTC

Dernière activité (filtres)

26/07/2026 20:36 UTC

Événements 7j

957

Ports distincts (7j)

912

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 690 HTTP TCP 45 HTTPS TCP 5 ELASTICSEARCH TCP 4 RDP TCP 4 SMB TCP 3 COUCHBASE TCP 3 SAP Diag TCP 3 WEBLOGIC CLUSTER TCP 2 SAP ICM TCP 2 WEBLOGIC SSL TCP 2 SSH TCP 2 POSTGRES TCP 2 COUCHDB TCP 2 SMTP ALT TCP 2 I2P TCP 2 S7COMM TCP 2 LDAP TCP 2 WINRM TCP 2 REDIS TCP 2

TLS

690

HTTP

HTTPS

ELASTICSEARCH

RDP

SMB

Géolocalisation

Origine réseau déclarée

Roumanie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Unmanaged Ltd 0 Port 10005 postgres_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP ALT 8087:8087 · (reconnaissance)

Détails protocole

Empreinte JA3: cba7f34191ef2379c1325641
Empreinte JA4: a3a5f53d3656a0df675e8aa0

Aperçu payload

{w��z��jg�?��'ߛ��m#Y��/�+�� /5� 4 �

Port / service

8087 · HTTP ALT 8087

Service émulé

HTTP-ALT-8087

Raison confiance

Confiance 100 % — 2 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

957 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

957 événement(s) — page 8/20

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
26/07/2026 20:36:22 UTC	TCP	8334 · TLS	tls	Scan de ports port scan syn · via TLS:8334 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8334 Chemin / cible — Service TLS Payload {w� v��f��WE[��EE��B�@Z�v<6��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�v��f��WE[��EE��B�@Z�v<6��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.876889444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8334, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "73532cf9a1248348f4718b678a1630adf38008c1", "event_fingerprint": "4c59e90045269762e156bd6589d01749f4cca1f3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "57bad91e72342bb853e8443abac549ea", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8334, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\fv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv\u0019<6\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\fv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv\u0019<6\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\fv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv\u0019<6\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "554865eb1d63da33cbed509140edfa925a8a6e51", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\fv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv\u0019<6\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8334, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffdv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv<6\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8334 \u00b7 (reconnaissance)", "target_port_label": "8334 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (83 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8334, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\fv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv\u0019<6\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8334, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8334 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdv\ufffd\ufffdf\ufffd\ufffdWE[\ufffd\ufffd\ufffd\ufffd\ufffdEE\ufffd\ufffd\ufffdB\ufffd@Z\ufffdv<6\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8334 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8334" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 454, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 454, "scan_velocity_ports_per_s": 159.42, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 83, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase", "cpanel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7000 · CASSANDRA JMX	cassandra-jmx	Scan de ports port scan syn · via CASSANDRA JMX:7000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur CASSANDRA-JMX WAF — Recommandation Surveiller Tags cassandra_emulated net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7000 Chemin / cible — Service CASSANDRA JMX Payload {w�� t{{�T1�rE��Rٷ�(�q��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�� t{{�T1�rE��Rٷ�(�q��/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "4f4b0d0a", "emulator_response_len": 4, "bytes_in": 128, "payload_entropy": 4.823336686726627, "port_category": "registered", "org": "Unmanaged Ltd", "service": "cassandra-jmx", "app_proto": "cassandra-jmx", "asn": 47890, "country": "RO", "dst_port": 7000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0e837f001fe9fba5f7c6be4510527027bb99803e", "event_fingerprint": "0c69b3edfad1fd34f7b447e7480ba1b6050084c0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "cassandra-jmx", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cccbc153348f317cbb4a55a8a81f204c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7000, "service": "cassandra-jmx", "service_name": "cassandra-jmx", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd \u0002t{{\ufffdT1\ufffdrE\u0002\ufffd\u0019\ufffd\ufffdR\u001c\u0677\ufffd(\ufffdq\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd \u0002t{{\ufffdT1\ufffdrE\u0002\ufffd\u0019\ufffd\ufffdR\u001c\u0677\ufffd(\ufffdq\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd \u0002t{{\ufffdT1\ufffdrE\u0002\ufffd\u0019\ufffd\ufffdR\u001c\u0677\ufffd(\ufffdq\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "151b18926a74ff9a7ab2346ff759480cf5cf5ea9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd \u0002t{{\ufffdT1\ufffdrE\u0002\ufffd\u0019\ufffd\ufffdR\u001c\u0677\ufffd(\ufffdq\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7000, "service": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX" }, "evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffd t{{\ufffdT1\ufffdrE\ufffd\ufffd\ufffdR\u0677\ufffd(\ufffdq\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)", "target_port_label": "7000 \u00b7 CASSANDRA JMX", "emulator_service": "cassandra-jmx", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA JMX \u2014 multi-protocole (84 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX", "dst_port": 7000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra-jmx", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd \u0002t{{\ufffdT1\ufffdrE\u0002\ufffd\u0019\ufffd\ufffdR\u001c\u0677\ufffd(\ufffdq\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7000, "service": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX" }, "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffd t{{\ufffdT1\ufffdrE\ufffd\ufffd\ufffdR\u0677\ufffd(\ufffdq\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7000 \u00b7 CASSANDRA JMX", "emulator_service": "cassandra-jmx", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra_jmx", "service_banner": "honeypot-cassandra-jmx", "service_os": "linux", "dst_port": "7000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 455, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 455, "scan_velocity_ports_per_s": 159.48, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 84, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	8451 · TLS	tls	Scan de ports port scan syn · via TLS:8451 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8451 Chemin / cible — Service TLS Payload {wa��K��9�SL�.�m��h6��pj�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wa��K��9�SL�.�m��h6��pj�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8202870029331635, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8451, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a5adbe64b7e2d2398573deefdfb8634410a1bb7d", "event_fingerprint": "070ffcf314ec269a49a74d4050e0f7f814b5e880", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "4150fc35773d8074d48fd20614464b18", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8451, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003a\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\u0002\ufffdpj\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003a\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\u0002\ufffdpj\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003a\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\u0002\ufffdpj\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "00c62dc9a505ae7b9128b8cf1b2301e59b820867", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003a\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\u0002\ufffdpj\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8451, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wa\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\ufffdpj\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8451 \u00b7 (reconnaissance)", "target_port_label": "8451 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (84 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8451, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003a\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\u0002\ufffdpj\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8451, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8451 \u00b7 (reconnaissance)", "evidence_snippet": "{wa\ufffd\ufffd\ufffdK\ufffd\ufffd9\ufffdSL\ufffd.\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdh6\ufffd\ufffd\ufffd\ufffdpj\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8451 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8451" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 456, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 456, "scan_velocity_ports_per_s": 159.54, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 84, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7676 · TLS	tls	Scan de ports port scan syn · via TLS:7676 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7676 Chemin / cible — Service TLS Payload {w��d�)��1�·�g��A��#_�{��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��d�)��1�·�g��A��#_�{��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.867162002933164, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7676, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "91c49414ad5c18e7545e8bbec53904a726edb224", "event_fingerprint": "5bf588e12662c671f32a320286ab1a0d76ce174d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "fa8a34b7fd707119f5e377881bc49360", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7676, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdd\ufffd)\ufffd\u001a\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd\u0011{\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdd\ufffd)\ufffd\u001a\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd\u0011{\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdd\ufffd)\ufffd\u001a\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd\u0011{\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "080241df97fa283e19e09e098d031330e15241c2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdd\ufffd)\ufffd\u001a\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd\u0011{\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7676, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\ufffdd\ufffd)\ufffd\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd{\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7676 \u00b7 (reconnaissance)", "target_port_label": "7676 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (84 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7676, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdd\ufffd)\ufffd\u001a\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd\u0011{\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7676, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7676 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffdd\ufffd)\ufffd\ufffd1\ufffd\u0387\ufffdg\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd#_\uf8c8\ufffd{\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7676 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7676" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 457, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 457, "scan_velocity_ports_per_s": 159.58, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 84, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6686 · TLS	tls	Scan de ports port scan syn · via TLS:6686 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6686 Chemin / cible — Service TLS Payload {w�X��.�I�[A�[��o+0Z��ή��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�X��.�I�[A�[��o+0Z��ή��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.827426328502067, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6686, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "debff53873805a893099807e8c9ec27f9d7b41c1", "event_fingerprint": "f5b73595d325bf28d7b3cb9b19b9b7ae820258fc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "9b1687fc632117783e33d1cdf57861af", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6686, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\u0014\u0007\ufffd\ufffd.\ufffd\u0015I\ufffd\u0001[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\u0014\u0007\ufffd\ufffd.\ufffd\u0015I\ufffd\u0001[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\u0014\u0007\ufffd\ufffd.\ufffd\u0015I\ufffd\u0001[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "313663259b23a916502e9e7826edb6fb0a87c94e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\u0014\u0007\ufffd\ufffd.\ufffd\u0015I\ufffd\u0001[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6686, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffdX\ufffd\ufffd.\ufffdI\ufffd[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6686 \u00b7 (reconnaissance)", "target_port_label": "6686 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (84 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6686, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\u0014\u0007\ufffd\ufffd.\ufffd\u0015I\ufffd\u0001[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6686, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6686 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdX\ufffd\ufffd.\ufffdI\ufffd[A\ufffd[\ufffd\ufffd\ufffd\ufffdo+0Z\ufffd\ufffd\u03ae\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6686 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6686" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 458, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 458, "scan_velocity_ports_per_s": 159.64, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 84, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7007 · WEBLOGIC CLUSTER	weblogic-cluster	Scan de ports port scan syn · via WEBLOGIC CLUSTER:7007 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur WEBLOGIC-CLUSTER WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7007 Chemin / cible — Service WEBLOGIC CLUSTER Payload {w,��{��D+vk$��s��U �<� �=�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w,��{��D+vk$��s��U �<��=�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.7734120029331635, "port_category": "registered", "org": "Unmanaged Ltd", "service": "weblogic-cluster", "app_proto": "weblogic-cluster", "asn": 47890, "country": "RO", "dst_port": 7007, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3d810c00589cb60dd6d520adb57348ec4a99e6be", "event_fingerprint": "806a4b333c9480802fcc146d650d9eb9f9376c08", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "weblogic-cluster", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a6a7cce92a6a0d60ecb167b709911492", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7007, "service": "weblogic-cluster", "service_name": "weblogic-cluster", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\u0006{\ufffd\ufffdD+vk$\ufffd\ufffds\u0002\ufffd\u001a\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\u000b\u0016\ufffd=\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\u0006{\ufffd\ufffdD+vk$\ufffd\ufffds\u0002\ufffd\u001a\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\u000b\u0016\ufffd=\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\u0006{\ufffd\ufffdD+vk$\ufffd\ufffds\u0002\ufffd\u001a\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\u000b\u0016\ufffd=\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cdd7a55604719e859c80e8534fbe2418061ec376", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\u0006{\ufffd\ufffdD+vk$\ufffd\ufffds\u0002\ufffd\u001a\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\u000b\u0016\ufffd=\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7007, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "evidence_snippet": "{w,\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdD+vk$\ufffd\ufffds\ufffd\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\ufffd=\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (reconnaissance)", "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBLOGIC CLUSTER \u2014 multi-protocole (85 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER", "dst_port": 7007, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic-cluster", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\u0006{\ufffd\ufffdD+vk$\ufffd\ufffds\u0002\ufffd\u001a\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\u000b\u0016\ufffd=\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7007, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "attack_vector": "port scan syn \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (reconnaissance)", "evidence_snippet": "{w,\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdD+vk$\ufffd\ufffds\ufffd\ufffd\ufffd\ufffdU\r\ufffd<\ufffd\ufffd=\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic_cluster", "service_banner": "honeypot-weblogic-cluster", "service_os": "linux", "dst_port": "7007" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 459, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 459, "scan_velocity_ports_per_s": 159.69, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 85, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	8060 · HTTP ALT 8060	http-alt-8060	Scan de ports port scan syn · via HTTP ALT 8060:8060 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur HTTP-ALT-8060 WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8060 Chemin / cible — Service HTTP ALT 8060 Payload {w�!I�d�cъ1��9�i�n�� Ch�� /�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�!I�d�cъ1��9�i�n�� Ch�� /�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.898412002933164, "port_category": "registered", "org": "Unmanaged Ltd", "service": "http-alt-8060", "app_proto": "http-alt-8060", "asn": 47890, "country": "RO", "dst_port": 8060, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "aab47e9e3d9a35c3e51800c2d6b6d1564b864959", "event_fingerprint": "3819dbd6011054f1d578fda3ac96df5957470b8c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http-alt-8060", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "42aa90c7a516448d0f9214df8ffcbb56", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8060, "service": "http-alt-8060", "service_name": "http-alt-8060", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd!I\ufffdd\ufffd\u0011c\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\u0015\ufffdCh\ufffd\ufffd\ufffd\u001e\ufffd\ufffd \u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd!I\ufffdd\ufffd\u0011c\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\u0015\ufffdCh\ufffd\ufffd\ufffd\u001e\ufffd\ufffd \u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd!I\ufffdd\ufffd\u0011c\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\u0015\ufffdCh\ufffd\ufffd\ufffd\u001e\ufffd\ufffd \u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4d6b9c921962fa415e57e4b04b81c2ec8d673879", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd!I\ufffdd\ufffd\u0011c\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\u0015\ufffdCh\ufffd\ufffd\ufffd\u001e\ufffd\ufffd \u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8060, "service": "http-alt-8060", "service_label_fr": "HTTP ALT 8060" }, "evidence_snippet": "{w\ufffd!I\ufffdd\ufffdc\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\ufffdCh\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via HTTP ALT 8060:8060 \u00b7 (reconnaissance)", "target_port_label": "8060 \u00b7 HTTP ALT 8060", "emulator_service": "http-alt-8060", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8060 \u2014 multi-protocole (86 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8060", "service_label_fr": "HTTP ALT 8060", "dst_port": 8060, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8060", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd!I\ufffdd\ufffd\u0011c\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\u0015\ufffdCh\ufffd\ufffd\ufffd\u001e\ufffd\ufffd \u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8060, "service": "http-alt-8060", "service_label_fr": "HTTP ALT 8060" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8060:8060 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd!I\ufffdd\ufffdc\u044a1\ufffd\ufffd9\ufffdi\ufffdn\ufffd\ufffd\t\ufffdCh\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8060 \u00b7 HTTP ALT 8060", "emulator_service": "http-alt-8060", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8060", "service_banner": "honeypot-http-alt-8060", "service_os": "linux", "dst_port": "8060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 460, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 460, "scan_velocity_ports_per_s": 159.74, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 86, "multi_protocol_sample": [ "aim", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel", "couchbase" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	8009 · AJP	ajp	Scan de ports port scan syn · via AJP:8009 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur AJP WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8009 Chemin / cible — Service AJP Payload {w�En��}OԌ�y��6p�%�YP�y�{E�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�En��}OԌ�y��6p�%�YP�y�{E�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.779858863244334, "port_category": "registered", "org": "Unmanaged Ltd", "service": "ajp", "app_proto": "ajp", "asn": 47890, "country": "RO", "dst_port": 8009, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "af9c116824ee998c772398177a923bfd6654a279", "event_fingerprint": "29aa72764a8ec053b6b70ccc727e3e945d983117", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "ajp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ce02c51fce980450e58f0d1bf52e6d80", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8009, "service": "ajp", "service_name": "ajp", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdEn\ufffd\u0019\ufffd\ufffd}O\u001e\u050c\ufffdy\ufffd\ufffd6p\ufffd\u0019\u000e%\ufffdYP\ufffdy\u0000\u001b\ufffd{E\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdEn\ufffd\u0019\ufffd\ufffd}O\u001e\u050c\ufffdy\ufffd\ufffd6p\ufffd\u0019\u000e%\ufffdYP\ufffdy\u0000\u001b\ufffd{E\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdEn\ufffd\u0019\ufffd\ufffd}O\u001e\u050c\ufffdy\ufffd\ufffd6p\ufffd\u0019\u000e%\ufffdYP\ufffdy\u0000\u001b\ufffd{E\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9eaa8f1b3e2e5ad44aa03f464760698f773e8411", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdEn\ufffd\u0019\ufffd\ufffd}O\u001e\u050c\ufffdy\ufffd\ufffd6p\ufffd\u0019\u000e%\ufffdYP\ufffdy\u0000\u001b\ufffd{E\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8009, "service": "ajp", "service_label_fr": "AJP" }, "evidence_snippet": "{w\ufffdEn\ufffd\ufffd\ufffd}O\u050c\ufffdy\ufffd\ufffd6p\ufffd%\ufffdYP\ufffdy\ufffd{E\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via AJP:8009 \u00b7 (reconnaissance)", "target_port_label": "8009 \u00b7 AJP", "emulator_service": "ajp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AJP \u2014 multi-protocole (87 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "ajp", "service_label_fr": "AJP", "dst_port": 8009, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-ajp", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdEn\ufffd\u0019\ufffd\ufffd}O\u001e\u050c\ufffdy\ufffd\ufffd6p\ufffd\u0019\u000e%\ufffdYP\ufffdy\u0000\u001b\ufffd{E\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8009, "service": "ajp", "service_label_fr": "AJP" }, "attack_vector": "port scan syn \u00b7 via AJP:8009 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdEn\ufffd\ufffd\ufffd}O\u050c\ufffdy\ufffd\ufffd6p\ufffd%\ufffdYP\ufffdy\ufffd{E\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8009 \u00b7 AJP", "emulator_service": "ajp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ajp", "service_banner": "honeypot-ajp", "service_os": "linux", "dst_port": "8009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 461, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 461, "scan_velocity_ports_per_s": 159.78, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 87, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	809 · TLS	tls	Scan de ports port scan syn · via TLS:809 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 809 Chemin / cible — Service TLS Payload {w^�~ F�U$T�""�&�]硫�nE�E"��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w^�~ F�U$T�""�&�]硫�nE�E"��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.765706527487302, "port_category": "well_known", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 809, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "329f3015fa5e2bb705e0c955ae67222434c007cf", "event_fingerprint": "4537af70caa8fabb3ac3bc7cb8cd448723b0a9c7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "4dc021105b4ab5f432f788d347d5b498", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 809, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003^\u0001\ufffd\u000e~\n\u0003F\ufffdU$T\ufffd\"\"\b\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\u0015\"\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003^\u0001\ufffd\u000e~\n\u0003F\ufffdU$T\ufffd\"\"\b\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\u0015\"\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003^\u0001\ufffd\u000e~\n\u0003F\ufffdU$T\ufffd\"\"\b\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\u0015\"\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e81ef2c02f34b2880794e9a569a092b2ba738e5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003^\u0001\ufffd\u000e~\n\u0003F\ufffdU$T\ufffd\"\"\b\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\u0015\"\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 809, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w^\ufffd~\nF\ufffdU$T\ufffd\"\"\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\"\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:809 \u00b7 (reconnaissance)", "target_port_label": "809 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (87 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 809, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003^\u0001\ufffd\u000e~\n\u0003F\ufffdU$T\ufffd\"\"\b\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\u0015\"\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 809, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:809 \u00b7 (reconnaissance)", "evidence_snippet": "{w^\ufffd~\nF\ufffdU$T\ufffd\"\"\ufffd&\ufffd]\uf9ce\ufffdnE\ufffdE\"\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "809 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "809" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 462, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 462, "scan_velocity_ports_per_s": 159.79, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 87, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7989 · TLS	tls	Scan de ports port scan syn · via TLS:7989 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7989 Chemin / cible — Service TLS Payload {w�؎�� K��E��F9�@�A��F#�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�؎��K��E��F9�@�A��F#�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.861264444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7989, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4c4c3d3032b99ccedb79cc557295d0642c1cb4e6", "event_fingerprint": "39e76de22351506f480d28dc57c06e1d612290c1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "2bfd692d6c4d27453ee2e73aa3f28983", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7989, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u060e\ufffd\ufffd\u000b\ufffd\u0011K\ufffd\ufffdE\ufffd\ufffd\u001e\ufffd\ufffd\u000f\u0006F9\ufffd@\ufffdA\ufffd\ufffdF#\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u060e\ufffd\ufffd\u000b\ufffd\u0011K\ufffd\ufffdE\ufffd\ufffd\u001e\ufffd\ufffd\u000f\u0006F9\ufffd@\ufffdA\ufffd\ufffdF#\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u060e\ufffd\ufffd\u000b\ufffd\u0011K\ufffd\ufffdE\ufffd\ufffd\u001e\ufffd\ufffd\u000f\u0006F9\ufffd@\ufffdA\ufffd\ufffdF#\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fd47e07388387b3be3037ef6520b36a4e45de73", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u060e\ufffd\ufffd\u000b\ufffd\u0011K\ufffd\ufffdE\ufffd\ufffd\u001e\ufffd\ufffd\u000f\u0006F9\ufffd@\ufffdA\ufffd\ufffdF#\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7989, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\u060e\ufffd\ufffd\ufffdK\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdF9\ufffd@\ufffdA\ufffd\ufffdF#\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7989 \u00b7 (reconnaissance)", "target_port_label": "7989 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (87 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7989, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u060e\ufffd\ufffd\u000b\ufffd\u0011K\ufffd\ufffdE\ufffd\ufffd\u001e\ufffd\ufffd\u000f\u0006F9\ufffd@\ufffdA\ufffd\ufffdF#\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7989, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7989 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\u060e\ufffd\ufffd\ufffdK\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdF9\ufffd@\ufffdA\ufffd\ufffdF#\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7989 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7989" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 463, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 463, "scan_velocity_ports_per_s": 159.84, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 87, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7170 · TLS	tls	Scan de ports port scan syn · via TLS:7170 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7170 Chemin / cible — Service TLS Payload {w��Q[ر�z -��Oб�itO0�RI�ċ�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��Q[ر�z -��Oб�itO0�RI�ċ�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.778982655450329, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7170, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2c0dddc5a00ef51b057b1c640039b1424250c660", "event_fingerprint": "fcb6e65bdb88cbc2325e9381923e580e65471803", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "d574bacac00937044e5a6a6c4281b667", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7170, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdQ[\u0631\u0003\ufffd\u001dz\n\u0014-\ufffd\u0003\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdQ[\u0631\u0003\ufffd\u001dz\n\u0014-\ufffd\u0003\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdQ[\u0631\u0003\ufffd\u001dz\n\u0014-\ufffd\u0003\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9302d36e758a1e78eedd164d9cc0a6ae10f6427e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdQ[\u0631\u0003\ufffd\u001dz\n\u0014-\ufffd\u0003\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7170, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\ufffdQ[\u0631\ufffdz\n-\ufffd\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7170 \u00b7 (reconnaissance)", "target_port_label": "7170 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (87 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7170, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdQ[\u0631\u0003\ufffd\u001dz\n\u0014-\ufffd\u0003\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7170, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7170 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffdQ[\u0631\ufffdz\n-\ufffd\ufffdO\u0431\ufffditO0\ufffdRI\ufffd\u010b\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7170 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7170" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 464, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 464, "scan_velocity_ports_per_s": 159.91, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 87, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8570 · TLS	tls	Scan de ports port scan syn · via TLS:8570 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8570 Chemin / cible — Service TLS Payload {wi�x��m��(�5��r�֞4�X�WaQ�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wi�x��m��(�5��r�֞4�X�WaQ�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.755748188813238, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8570, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "efac24a2030581ffc491a5c9dbc800beab682aa5", "event_fingerprint": "79cd22ccab18efb5a151e12862a44b1ff7e8463a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "b1992776bcff60d192ba04bc31de1f84", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8570, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003i\ufffd\u0014x\ufffd\ufffd\u0010\ufffd\ufffdm\ufffd\u0006\ufffd(\ufffd5\ufffd\u0001\u0015\ufffdr\ufffd\u059e4\ufffdX\ufffdWa\u0000Q\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003i\ufffd\u0014x\ufffd\ufffd\u0010\ufffd\ufffdm\ufffd\u0006\ufffd(\ufffd5\ufffd\u0001\u0015\ufffdr\ufffd\u059e4\ufffdX\ufffdWa\u0000Q\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003i\ufffd\u0014x\ufffd\ufffd\u0010\ufffd\ufffdm\ufffd\u0006\ufffd(\ufffd5\ufffd\u0001\u0015\ufffdr\ufffd\u059e4\ufffdX\ufffdWa\u0000Q\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95dc7d864262dfa7f34106f4344a04e9661de4cd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003i\ufffd\u0014x\ufffd\ufffd\u0010\ufffd\ufffdm\ufffd\u0006\ufffd(\ufffd5\ufffd\u0001\u0015\ufffdr\ufffd\u059e4\ufffdX\ufffdWa\u0000Q\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8570, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wi\ufffdx\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd(\ufffd5\ufffd\ufffdr\ufffd\u059e4\ufffdX\ufffdWaQ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8570 \u00b7 (reconnaissance)", "target_port_label": "8570 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (87 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8570, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003i\ufffd\u0014x\ufffd\ufffd\u0010\ufffd\ufffdm\ufffd\u0006\ufffd(\ufffd5\ufffd\u0001\u0015\ufffdr\ufffd\u059e4\ufffdX\ufffdWa\u0000Q\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8570, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8570 \u00b7 (reconnaissance)", "evidence_snippet": "{wi\ufffdx\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd(\ufffd5\ufffd\ufffdr\ufffd\u059e4\ufffdX\ufffdWaQ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8570 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8570" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 465, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 465, "scan_velocity_ports_per_s": 159.98, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 87, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8003 · HTTP ALT 8003	http-alt-8003	Scan de ports port scan syn · via HTTP ALT 8003:8003 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur HTTP-ALT-8003 WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8003 Chemin / cible — Service HTTP ALT 8003 Payload {w��#(��X0$ ��'�u�]�{k�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��#(��X0$ ��'�u�]�{k�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.800051921169235, "port_category": "registered", "org": "Unmanaged Ltd", "service": "http-alt-8003", "app_proto": "http-alt-8003", "asn": 47890, "country": "RO", "dst_port": 8003, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8e018f8a62fefbb216a3765c2180c476b7e1e86f", "event_fingerprint": "b5a36a061b3730ee9707c59eadbd5e034e233402", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http-alt-8003", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b917c0cbeb7bcafcbf6a83d80ecdd3c8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8003, "service": "http-alt-8003", "service_name": "http-alt-8003", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0003\u000f\ufffd\ufffd\ufffd#(\ufffd\ufffd\u000fX0$\t\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd\u0013]\ufffd{k\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0003\u000f\ufffd\ufffd\ufffd#(\ufffd\ufffd\u000fX0$\t\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd\u0013]\ufffd{k\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0003\u000f\ufffd\ufffd\ufffd#(\ufffd\ufffd\u000fX0$\t\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd\u0013]\ufffd{k\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "899c2bd19b5887b36667e44c40092373c0134ee2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0003\u000f\ufffd\ufffd\ufffd#(\ufffd\ufffd\u000fX0$\t\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd\u0013]\ufffd{k\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8003, "service": "http-alt-8003", "service_label_fr": "HTTP ALT 8003" }, "evidence_snippet": "{w\ufffd\ufffd\ufffd#(\ufffd\ufffdX0$\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd]\ufffd{k\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via HTTP ALT 8003:8003 \u00b7 (reconnaissance)", "target_port_label": "8003 \u00b7 HTTP ALT 8003", "emulator_service": "http-alt-8003", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8003 \u2014 multi-protocole (88 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8003", "service_label_fr": "HTTP ALT 8003", "dst_port": 8003, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8003", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0003\u000f\ufffd\ufffd\ufffd#(\ufffd\ufffd\u000fX0$\t\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd\u0013]\ufffd{k\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8003, "service": "http-alt-8003", "service_label_fr": "HTTP ALT 8003" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8003:8003 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffd\ufffd#(\ufffd\ufffdX0$\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdu\ufffd]\ufffd{k\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8003 \u00b7 HTTP ALT 8003", "emulator_service": "http-alt-8003", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8003", "service_banner": "honeypot-http-alt-8003", "service_os": "linux", "dst_port": "8003" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 466, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 466, "scan_velocity_ports_per_s": 160.03, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 88, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	8513 · TLS	tls	Scan de ports port scan syn · via TLS:8513 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8513 Chemin / cible — Service TLS Payload {w��F�q��9�d��wM��dW)�lA��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��F�q��9�d��wM��dW)�lA��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8671620029331635, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8513, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2a173815cfe523847fb9c3fede20790083cf1379", "event_fingerprint": "684e1a60729b103a2fbc661faf3417cde7a65d9e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "f66e70628340a5898a04c4f6fd1e9cf5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8513, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\u0016\ufffdd\ufffd\ufffdwM\ufffd\u0012\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\u0016\ufffdd\ufffd\ufffdwM\ufffd\u0012\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\u0016\ufffdd\ufffd\ufffdwM\ufffd\u0012\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ac3d70535662067fe8146ca9af20dd7e02c4b0e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\u0016\ufffdd\ufffd\ufffdwM\ufffd\u0012\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8513, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffdd\ufffd\ufffdwM\ufffd\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8513 \u00b7 (reconnaissance)", "target_port_label": "8513 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (88 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8513, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\u0016\ufffdd\ufffd\ufffdwM\ufffd\u0012\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8513, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8513 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffdF\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffdd\ufffd\ufffdwM\ufffd\ufffd\ufffddW)\ufffdlA\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8513 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8513" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 467, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 467, "scan_velocity_ports_per_s": 160.08, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 88, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6668 · TLS	tls	Scan de ports port scan syn · via TLS:6668 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6668 Chemin / cible — Service TLS Payload {wN��8��]C��s� t�� y[֓>i�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wN��8��]C��s� t��y[֓>i�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.861264444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6668, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2036685fb1daf68f4fcde31ed4ee256920eab024", "event_fingerprint": "c865ad1461aeda53cd8ac060aa0ec64f55e82d86", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "efc381beecd2c8d194db5bca06045497", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6668, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003N\ufffd\ufffd\ufffd8\u001a\ufffd\u0010\ufffd\u001a\ufffd\u001f]C\ufffd\ufffd\u0011s\ufffd\tt\ufffd\ufffd\f\ufffdy[\u0593>i\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003N\ufffd\ufffd\ufffd8\u001a\ufffd\u0010\ufffd\u001a\ufffd\u001f]C\ufffd\ufffd\u0011s\ufffd\tt\ufffd\ufffd\f\ufffdy[\u0593>i\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003N\ufffd\ufffd\ufffd8\u001a\ufffd\u0010\ufffd\u001a\ufffd\u001f]C\ufffd\ufffd\u0011s\ufffd\tt\ufffd\ufffd\f\ufffdy[\u0593>i\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38a33030321fbdcfe38bf4771d137393b7b8dd1d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003N\ufffd\ufffd\ufffd8\u001a\ufffd\u0010\ufffd\u001a\ufffd\u001f]C\ufffd\ufffd\u0011s\ufffd\tt\ufffd\ufffd\f\ufffdy[\u0593>i\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6668, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wN\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd]C\ufffd\ufffds\ufffd\tt\ufffd\ufffd\ufffdy[\u0593>i\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6668 \u00b7 (reconnaissance)", "target_port_label": "6668 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (88 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6668, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003N\ufffd\ufffd\ufffd8\u001a\ufffd\u0010\ufffd\u001a\ufffd\u001f]C\ufffd\ufffd\u0011s\ufffd\tt\ufffd\ufffd\f\ufffdy[\u0593>i\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6668, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6668 \u00b7 (reconnaissance)", "evidence_snippet": "{wN\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd]C\ufffd\ufffds\ufffd\tt\ufffd\ufffd\ufffdy[\u0593>i\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6668 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6668" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 468, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 468, "scan_velocity_ports_per_s": 158.44, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 88, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7083 · TLS	tls	Scan de ports port scan syn · via TLS:7083 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7083 Chemin / cible — Service TLS Payload {w��<��"�1�E�}{͑\�w��>O�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��<��"�1�E�}{͑\�w��>O�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8246241635733496, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7083, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b6dcc5fc68863b055eb495393883eed5e1b141c5", "event_fingerprint": "9f6f846268741fbe772746014090187b61cef5fe", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "10648b7827240a7d735432f3818d4759", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7083, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\u0015\ufffd1\ufffdE\ufffd}\u0014{\u001a\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\u0014\ufffd>O\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\u0015\ufffd1\ufffdE\ufffd}\u0014{\u001a\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\u0014\ufffd>O\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\u0015\ufffd1\ufffdE\ufffd}\u0014{\u001a\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\u0014\ufffd>O\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "380a29aca77916ded8d990a82c2c76390886ca60", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\u0015\ufffd1\ufffdE\ufffd}\u0014{\u001a\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\u0014\ufffd>O\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7083, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\ufffd1\ufffdE\ufffd}{\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd>O\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7083 \u00b7 (reconnaissance)", "target_port_label": "7083 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (88 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7083, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\u0015\ufffd1\ufffdE\ufffd}\u0014{\u001a\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\u0014\ufffd>O\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7083, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7083 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\"\ufffd1\ufffdE\ufffd}{\u0351\\\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd>O\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7083 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 469, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 469, "scan_velocity_ports_per_s": 158.29, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 88, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7022 · TLS	tls	Scan de ports port scan syn · via TLS:7022 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7022 Chemin / cible — Service TLS Payload {w_��<�G� e��M�P��4��L�"s��gw�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w_��<�G�e��M�P��4��L�"s��gw�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.7739192807946536, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7022, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "03c3162f10a92d0ea15400553d799b7f87f681e5", "event_fingerprint": "26a1601cf0b467ae05353ac8e7e035b0be09e2a7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "57436c603e2c41409f6a89778b864f3b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7022, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003_\ufffd\ufffd\b<\ufffdG\u001a\ufffd\u0004\u000be\ufffd\ufffd\ufffdM\ufffd\u0013P\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003_\ufffd\ufffd\b<\ufffdG\u001a\ufffd\u0004\u000be\ufffd\ufffd\ufffdM\ufffd\u0013P\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003_\ufffd\ufffd\b<\ufffdG\u001a\ufffd\u0004\u000be\ufffd\ufffd\ufffdM\ufffd\u0013P\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "be0485ecedcf7a0cdaf5657e1c355284ebafb8bf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003_\ufffd\ufffd\b<\ufffdG\u001a\ufffd\u0004\u000be\ufffd\ufffd\ufffdM\ufffd\u0013P\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7022, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w_\ufffd\ufffd<\ufffdG\ufffde\ufffd\ufffd\ufffdM\ufffdP\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7022 \u00b7 (reconnaissance)", "target_port_label": "7022 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (88 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7022, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003_\ufffd\ufffd\b<\ufffdG\u001a\ufffd\u0004\u000be\ufffd\ufffd\ufffdM\ufffd\u0013P\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7022, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7022 \u00b7 (reconnaissance)", "evidence_snippet": "{w_\ufffd\ufffd<\ufffdG\ufffde\ufffd\ufffd\ufffdM\ufffdP\ufffd\ufffd4\ufffd\ufffdL\ufffd\"s\ufffd\ufffdgw\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7022 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7022" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 470, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 470, "scan_velocity_ports_per_s": 158.31, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 88, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6666 · IRC ALT	irc-alt	Scan de ports port scan syn · via IRC ALT:6666 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur IRC-ALT WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6666 Chemin / cible — Service IRC ALT Payload {wѿ�@��n��RY� яt%�$aڭt;{D�a�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wѿ�@��n��RY�яt%�$aڭt;{D�a�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a", "emulator_response_len": 50, "bytes_in": 128, "payload_entropy": 4.830014444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "irc-alt", "app_proto": "irc-alt", "asn": 47890, "country": "RO", "dst_port": 6666, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "79ccb7861061219edc54a690ed114e1abc99f894", "event_fingerprint": "86c0d7da10c1e9de2518b363d3d30267af6ded27", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "irc-alt", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "163a75c218ac879aac22af32a2e3455c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6666, "service": "irc-alt", "service_name": "irc-alt", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u047f\ufffd@\ufffd\ufffdn\ufffd\u0006\ufffd\ufffdRY\ufffd\f\u044ft%\ufffd$\u001fa\b\u06adt;{D\ufffda\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u047f\ufffd@\ufffd\ufffdn\ufffd\u0006\ufffd\ufffdRY\ufffd\f\u044ft%\ufffd$\u001fa\b\u06adt;{D\ufffda\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u047f\ufffd@\ufffd\ufffdn\ufffd\u0006\ufffd\ufffdRY\ufffd\f\u044ft%\ufffd$\u001fa\b\u06adt;{D\ufffda\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dbef23cbca68a4050543eaa51d5401cf3eaecde8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u047f\ufffd@\ufffd\ufffdn\ufffd\u0006\ufffd\ufffdRY\ufffd\f\u044ft%\ufffd$\u001fa\b\u06adt;{D\ufffda\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6666, "service": "irc-alt", "service_label_fr": "IRC ALT" }, "evidence_snippet": "{w\u047f\ufffd@\ufffd\ufffdn\ufffd\ufffd\ufffdRY\ufffd\u044ft%\ufffd$a\u06adt;{D\ufffda\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via IRC ALT:6666 \u00b7 (reconnaissance)", "target_port_label": "6666 \u00b7 IRC ALT", "emulator_service": "irc-alt", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IRC ALT \u2014 multi-protocole (89 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "irc-alt", "service_label_fr": "IRC ALT", "dst_port": 6666, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-irc-alt", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u047f\ufffd@\ufffd\ufffdn\ufffd\u0006\ufffd\ufffdRY\ufffd\f\u044ft%\ufffd$\u001fa\b\u06adt;{D\ufffda\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6666, "service": "irc-alt", "service_label_fr": "IRC ALT" }, "attack_vector": "port scan syn \u00b7 via IRC ALT:6666 \u00b7 (reconnaissance)", "evidence_snippet": "{w\u047f\ufffd@\ufffd\ufffdn\ufffd\ufffd\ufffdRY\ufffd\u044ft%\ufffd$a\u06adt;{D\ufffda\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6666 \u00b7 IRC ALT", "emulator_service": "irc-alt", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "irc_alt", "service_banner": "honeypot-irc-alt", "service_os": "linux", "dst_port": "6666" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 471, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 471, "scan_velocity_ports_per_s": 158.31, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 89, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	8098 · TLS	tls	Scan de ports port scan syn · via TLS:8098 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8098 Chemin / cible — Service TLS Payload {w�$��\|��4��78�4i��W=�A��&7�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�$��\|��4��78�4i��W=�A��&7�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.794934561543816, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8098, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a4bd2907fba5ac37f3cfe6893502772ded5c2b1c", "event_fingerprint": "59ec7d342a9e35624a9ebcf849cb50dce473b99e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "2a56b2ab014bd6d22f64eba3185d0a8e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8098, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd$\ufffd\ufffd\u001e\ufffd\|\u0002\ufffd\ufffd4\ufffd\ufffd7\b8\ufffd4i\ufffd\ufffdW=\ufffd\u0004A\ufffd\ufffd&7\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd$\ufffd\ufffd\u001e\ufffd\|\u0002\ufffd\ufffd4\ufffd\ufffd7\b8\ufffd4i\ufffd\ufffdW=\ufffd\u0004A\ufffd\ufffd&7\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd$\ufffd\ufffd\u001e\ufffd\|\u0002\ufffd\ufffd4\ufffd\ufffd7\b8\ufffd4i\ufffd\ufffdW=\ufffd\u0004A\ufffd\ufffd&7\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "01ea8fcd59227c190119132b31f56102396a6802", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd$\ufffd\ufffd\u001e\ufffd\|\u0002\ufffd\ufffd4\ufffd\ufffd7\b8\ufffd4i\ufffd\ufffdW=\ufffd\u0004A\ufffd\ufffd&7\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8098, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd$\ufffd\ufffd\ufffd\|\ufffd\ufffd4\ufffd\ufffd78\ufffd4i\ufffd\ufffdW=\ufffdA\ufffd\ufffd&7\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8098 \u00b7 (reconnaissance)", "target_port_label": "8098 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (89 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8098, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd$\ufffd\ufffd\u001e\ufffd\|\u0002\ufffd\ufffd4\ufffd\ufffd7\b8\ufffd4i\ufffd\ufffdW=\ufffd\u0004A\ufffd\ufffd&7\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8098, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8098 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd$\ufffd\ufffd\ufffd\|\ufffd\ufffd4\ufffd\ufffd78\ufffd4i\ufffd\ufffdW=\ufffdA\ufffd\ufffd&7\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8098 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8098" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 472, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 472, "scan_velocity_ports_per_s": 158.31, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 89, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8502 · TLS	tls	Scan de ports port scan syn · via TLS:8502 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8502 Chemin / cible — Service TLS Payload {w�rTZ G��Vdn\f��0�63��t_ߪ�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�rTZG��Vdn\f��0�63��t_ߪ�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.838961686726627, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8502, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f45a622912b5bf47a76edce09585b2bec79ca680", "event_fingerprint": "cca1d8b4ef54f790522e017fa59ac76f464b5eef", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "300eafe1489ad9160cb5aad05ef06065", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8502, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdrTZ\u000bG\ufffd\ufffd\ufffd\u0005Vdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt\u0016_\u0018\u0007\u07ea\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdrTZ\u000bG\ufffd\ufffd\ufffd\u0005Vdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt\u0016_\u0018\u0007\u07ea\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdrTZ\u000bG\ufffd\ufffd\ufffd\u0005Vdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt\u0016_\u0018\u0007\u07ea\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b1217b3c3276b331f4667cd521a2cf25859587b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdrTZ\u000bG\ufffd\ufffd\ufffd\u0005Vdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt\u0016_\u0018\u0007\u07ea\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8502, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffdrTZG\ufffd\ufffd\ufffdVdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt_\u07ea\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8502 \u00b7 (reconnaissance)", "target_port_label": "8502 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (89 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8502, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdrTZ\u000bG\ufffd\ufffd\ufffd\u0005Vdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt\u0016_\u0018\u0007\u07ea\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8502, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8502 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdrTZG\ufffd\ufffd\ufffdVdn\\f\ufffd\ufffd0\ufffd63\ufffd\ufffdt_\u07ea\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8502 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8502" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 473, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 473, "scan_velocity_ports_per_s": 158.32, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 89, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7657 · I2P ROUTER	i2p-router	Scan de ports port scan syn · via I2P ROUTER:7657 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur I2P-ROUTER WAF — Recommandation Surveiller Tags i2p_router_emulated i2p_router_payload net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7657 Chemin / cible — Service I2P ROUTER Payload {w��q��b�%M�؉��y�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w��q��b�%M�؉��y�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000010000000000000000000000000", "emulator_response_len": 16, "bytes_in": 128, "payload_entropy": 4.845639444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "i2p-router", "app_proto": "i2p-router", "asn": 47890, "country": "RO", "dst_port": 7657, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "fa3cc8e88a366dcbef34b0957eb64282742bd25c", "event_fingerprint": "ad231c09f274986ed2a9710385636dbf87a8b4db", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "i2p-router", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bb3c290f3ac3f119e6ece65044f198e3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7657, "service": "i2p-router", "service_name": "i2p-router", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\ufffdq\ufffd\ufffd\u001c\ufffdb\u0006\ufffd%M\u001b\ufffd\u0609\ufffd\u001b\ufffd\ufffd\u001e\ufffd\ufffd\b\ufffd\ufffdy\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\ufffdq\ufffd\ufffd\u001c\ufffdb\u0006\ufffd%M\u001b\ufffd\u0609\ufffd\u001b\ufffd\ufffd\u001e\ufffd\ufffd\b\ufffd\ufffdy\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\ufffdq\ufffd\ufffd\u001c\ufffdb\u0006\ufffd%M\u001b\ufffd\u0609\ufffd\u001b\ufffd\ufffd\u001e\ufffd\ufffd\b\ufffd\ufffdy\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f77e288b19e2541e5f6b910add97778081e3847", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\ufffdq\ufffd\ufffd\u001c\ufffdb\u0006\ufffd%M\u001b\ufffd\u0609\ufffd\u001b\ufffd\ufffd\u001e\ufffd\ufffd\b\ufffd\ufffdy\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdb\ufffd%M\ufffd\u0609\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via I2P ROUTER:7657 \u00b7 (reconnaissance)", "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via I2P ROUTER \u2014 multi-protocole (90 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "i2p-router", "service_label_fr": "I2P ROUTER", "dst_port": 7657, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-i2p-router", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\ufffdq\ufffd\ufffd\u001c\ufffdb\u0006\ufffd%M\u001b\ufffd\u0609\ufffd\u001b\ufffd\ufffd\u001e\ufffd\ufffd\b\ufffd\ufffdy\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "attack_vector": "port scan syn \u00b7 via I2P ROUTER:7657 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdb\ufffd%M\ufffd\u0609\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "i2p_router", "service_banner": "honeypot-i2p-router", "service_os": "linux", "dst_port": "7657" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 474, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 474, "scan_velocity_ports_per_s": 158.34, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 90, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "i2p_router_emulated", "i2p_router_payload", "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	5683 · COAP	coap	Scan de ports port scan syn · via COAP:5683 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur COAP WAF — Recommandation Surveiller Tags coap_emulated coap_payload net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5683 Chemin / cible — Service COAP Payload {w�A� ����[��e��.�d/��j�<��/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�A� ����[��e��.�d/��j�<��/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "60440000d1044e6f6e65", "emulator_response_len": 10, "bytes_in": 128, "payload_entropy": 4.867162002933164, "port_category": "registered", "org": "Unmanaged Ltd", "service": "coap", "app_proto": "coap", "asn": 47890, "country": "RO", "dst_port": 5683, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "e31487835674dac380ca10b11050e4535709572a", "event_fingerprint": "cdfcf387793f305d1129c334e395eeebb0f897bf", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "coap", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "086fc63821f747c4f25fe368df500d60", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5683, "service": "coap", "service_name": "coap", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdA\ufffd\n\ufffd\ufffd\u0010\ufffd\ufffd[\ufffd\u000f\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\u001d\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdA\ufffd\n\ufffd\ufffd\u0010\ufffd\ufffd[\ufffd\u000f\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\u001d\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdA\ufffd\n\ufffd\ufffd\u0010\ufffd\ufffd[\ufffd\u000f\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\u001d\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7b318f7db48c644c2a38f250b445c222315057a2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdA\ufffd\n\ufffd\ufffd\u0010\ufffd\ufffd[\ufffd\u000f\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\u001d\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5683, "service": "coap", "service_label_fr": "COAP" }, "evidence_snippet": "{w\ufffdA\ufffd\n\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via COAP:5683 \u00b7 (reconnaissance)", "target_port_label": "5683 \u00b7 COAP", "emulator_service": "coap", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COAP \u2014 multi-protocole (91 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "coap", "service_label_fr": "COAP", "dst_port": 5683, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "CoAP\/1.0", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdA\ufffd\n\ufffd\ufffd\u0010\ufffd\ufffd[\ufffd\u000f\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\u001d\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5683, "service": "coap", "service_label_fr": "COAP" }, "attack_vector": "port scan syn \u00b7 via COAP:5683 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdA\ufffd\n\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd.\ufffdd\/\ufffd\ufffdj\ufffd<\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5683 \u00b7 COAP", "emulator_service": "coap", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "coap", "service_banner": "CoAP\/1.0", "service_os": "iot", "dst_port": "5683" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 475, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 475, "scan_velocity_ports_per_s": 158.35, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 91, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "coap_emulated", "coap_payload", "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	5555 · PERSONAL AGENT	personal-agent	Scan de ports port scan syn · via PERSONAL AGENT:5555 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur PERSONAL-AGENT WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5555 Chemin / cible — Service PERSONAL AGENT Payload {wô�Q&긄��mg��9�� 8v&�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wô�Q&긄��mg��9��8v&�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420706572736f6e616c5f6167656e7420726561647920706f72743d353535350d0a", "emulator_response_len": 45, "bytes_in": 128, "payload_entropy": 4.8984120029331635, "port_category": "registered", "org": "Unmanaged Ltd", "service": "personal-agent", "app_proto": "personal-agent", "asn": 47890, "country": "RO", "dst_port": 5555, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c9814cc4b990701af84d8832f7cc169e30ca5e96", "event_fingerprint": "6f069dfd8645ca575ff901e9769ca70d6b9a4b79", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "personal-agent", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b2df249c5091972b5ced5b2a9a8ff65a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5555, "service": "personal-agent", "service_name": "personal-agent", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd9\ufffd\ufffd\u000b\ufffd8v&\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd9\ufffd\ufffd\u000b\ufffd8v&\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd9\ufffd\ufffd\u000b\ufffd8v&\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "71976421516ea4aa867d662327300f24bc9a27c2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd9\ufffd\ufffd\u000b\ufffd8v&\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "evidence_snippet": "{w\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd8v&\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via PERSONAL AGENT:5555 \u00b7 (reconnaissance)", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PERSONAL AGENT \u2014 multi-protocole (92 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "personal-agent", "service_label_fr": "PERSONAL AGENT", "dst_port": 5555, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-personal-agent", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd9\ufffd\ufffd\u000b\ufffd8v&\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "attack_vector": "port scan syn \u00b7 via PERSONAL AGENT:5555 \u00b7 (reconnaissance)", "evidence_snippet": "{w\u00f4\ufffdQ&\uae04\ufffd\ufffdmg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd8v&\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "personal_agent", "service_banner": "honeypot-personal-agent", "service_os": "linux", "dst_port": "5555" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 476, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 476, "scan_velocity_ports_per_s": 158.38, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 92, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	5680 · TLS	tls	Scan de ports port scan syn · via TLS:5680 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5680 Chemin / cible — Service TLS Payload {wZ�)鴔���!\��ѕ��O�͂�V�/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wZ�)鴔���!\��ѕ��O�͂�V�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8418095615438155, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5680, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a0ade6e499a07c57d77cbed2b3cc6d0e58a7f9af", "event_fingerprint": "3d7f45b4b213eaf0ba875a61a15fc0674bdd6216", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "e56dfa4a131f14177cddfc85238cdd49", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5680, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003Z\ufffd)\u9d14\ufffd\ufffd\ufffd\u0016\ufffd\ufffd!\\\ufffd\ufffd\u0013\u0019\u0002\ufffd\u0455\ufffd\ufffd\u0018O\ufffd\u0342\ufffdV\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003Z\ufffd)\u9d14\ufffd\ufffd\ufffd\u0016\ufffd\ufffd!\\\ufffd\ufffd\u0013\u0019\u0002\ufffd\u0455\ufffd\ufffd\u0018O\ufffd\u0342\ufffdV\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003Z\ufffd)\u9d14\ufffd\ufffd\ufffd\u0016\ufffd\ufffd!\\\ufffd\ufffd\u0013\u0019\u0002\ufffd\u0455\ufffd\ufffd\u0018O\ufffd\u0342\ufffdV\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7d24ed49ecca5341fb4c79009af4f67a103b8355", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003Z\ufffd)\u9d14\ufffd\ufffd\ufffd\u0016\ufffd\ufffd!\\\ufffd\ufffd\u0013\u0019\u0002\ufffd\u0455\ufffd\ufffd\u0018O\ufffd\u0342\ufffdV\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5680, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wZ\ufffd)\u9d14\ufffd\ufffd\ufffd\ufffd\ufffd!\\\ufffd\ufffd\ufffd\u0455\ufffd\ufffdO\ufffd\u0342\ufffdV\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5680 \u00b7 (reconnaissance)", "target_port_label": "5680 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (92 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5680, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003Z\ufffd)\u9d14\ufffd\ufffd\ufffd\u0016\ufffd\ufffd!\\\ufffd\ufffd\u0013\u0019\u0002\ufffd\u0455\ufffd\ufffd\u0018O\ufffd\u0342\ufffdV\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5680, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5680 \u00b7 (reconnaissance)", "evidence_snippet": "{wZ\ufffd)\u9d14\ufffd\ufffd\ufffd\ufffd\ufffd!\\\ufffd\ufffd\ufffd\u0455\ufffd\ufffdO\ufffd\u0342\ufffdV\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5680 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5680" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 477, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 477, "scan_velocity_ports_per_s": 158.4, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 92, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5902 · VNC 2	vnc-2	Scan de ports port scan syn · via VNC 2:5902 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur VNC-2 WAF — Recommandation Surveiller Tags net_flood tls_clienthello vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5902 Chemin / cible — Service VNC 2 Payload {w�@�TG`Qvl3;�V�fV�K��8��R��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�@�TG`Qvl3;�V�fV�K��8��R��/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "524642203030332e3030380a", "emulator_response_len": 12, "bytes_in": 128, "payload_entropy": 4.815169643307746, "port_category": "registered", "org": "Unmanaged Ltd", "service": "vnc-2", "app_proto": "vnc-2", "asn": 47890, "country": "RO", "dst_port": 5902, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "414557b85f7fc3649c7b96fc96325c78f9707499", "event_fingerprint": "2c72b6cb0c656618aa3144508933d537d6b53383", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "vnc-2", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05fea7ab18c87e60cec3fac40b265328", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5902, "service": "vnc-2", "service_name": "vnc-2", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0006\u0007@\ufffdTG`Qvl3;\ufffdV\u001a\ufffdfV\ufffdK\u0003\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0006\u0007@\ufffdTG`Qvl3;\ufffdV\u001a\ufffdfV\ufffdK\u0003\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0006\u0007@\ufffdTG`Qvl3;\ufffdV\u001a\ufffdfV\ufffdK\u0003\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3f0349f8e80ffde2c1c5e1ec8bf0a9bcec47b9c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0006\u0007@\ufffdTG`Qvl3;\ufffdV\u001a\ufffdfV\ufffdK\u0003\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5902, "service": "vnc-2", "service_label_fr": "VNC 2" }, "evidence_snippet": "{w\ufffd@\ufffdTG`Qvl3;\ufffdV\ufffdfV\ufffdK\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via VNC 2:5902 \u00b7 (reconnaissance)", "target_port_label": "5902 \u00b7 VNC 2", "emulator_service": "vnc-2", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC 2 \u2014 multi-protocole (93 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "vnc-2", "service_label_fr": "VNC 2", "dst_port": 5902, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-vnc-2", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0006\u0007@\ufffdTG`Qvl3;\ufffdV\u001a\ufffdfV\ufffdK\u0003\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5902, "service": "vnc-2", "service_label_fr": "VNC 2" }, "attack_vector": "port scan syn \u00b7 via VNC 2:5902 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd@\ufffdTG`Qvl3;\ufffdV\ufffdfV\ufffdK\ufffd\ufffd\ufffd8\ufffd\ufffdR\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5902 \u00b7 VNC 2", "emulator_service": "vnc-2", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "vnc_2", "service_banner": "honeypot-vnc-2", "service_os": "linux", "dst_port": "5902" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 478, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 478, "scan_velocity_ports_per_s": 158.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 93, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello", "vnc_emulated" ] }
26/07/2026 20:36:22 UTC	TCP	556 · TLS	tls	Scan de ports port scan syn · via TLS:556 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 556 Chemin / cible — Service TLS Payload {w�>�M��YX�q��˾/i_��+ք�6��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�>�M��YX�q��˾/i_��+ք�6��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.861264444322512, "port_category": "well_known", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 556, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "0737597e69776d577f66fa6d2327e3decb044259", "event_fingerprint": "7e160d82ad75e073aa06b735558cbb07bfd50864", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "558d6ea602e57073fedf5248f6ef0876", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 556, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\u0011\ufffd6\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\u0011\ufffd6\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\u0011\ufffd6\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6522bcf39037ff7123ae5a081208f3e764211ae9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\u0011\ufffd6\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 556, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\ufffd6\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:556 \u00b7 (reconnaissance)", "target_port_label": "556 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (93 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 556, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\u0011\ufffd6\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 556, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:556 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd>\ufffdM\ufffd\ufffd\ufffd\ufffdYX\ufffdq\ufffd\ufffd\u02fe\/i_\ufffd\ufffd\ufffd+\u0584\ufffd6\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "556 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "556" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 479, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 479, "scan_velocity_ports_per_s": 158.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 93, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5911 · TLS	tls	Scan de ports port scan syn · via TLS:5911 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5911 Chemin / cible — Service TLS Payload {w9��˪]�@��E�6�Qc�m%F�I��9�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w9��˪]�@��E�6�Qc�m%F�I��9�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8461467221840016, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5911, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a12bcbaa27cba60e14fa5f4dd567df5a9217b3f5", "event_fingerprint": "2de5018336c5a90dfb503379c9471d03cc107337", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "410bb39ed54a18aa4a9a6452355ad177", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5911, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eeedd9356be51a08f8a26e19e0c6070682f98068", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5911, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5911 \u00b7 (reconnaissance)", "target_port_label": "5911 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (93 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5911, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5911, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5911 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ue01a9\ufffd\ufffd\u02ea]\ufffd@\ufffd\ufffd\ufffdE\ufffd6\ufffdQc\ufffdm%F\ufffdI\ufffd\ufffd\ufffd9\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5911 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5911" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 480, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 480, "scan_velocity_ports_per_s": 158.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 93, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	587 · SMTP SUBMISSION	smtp-submission	Scan de ports port scan syn · via SMTP SUBMISSION:587 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur SMTP-SUBMISSION WAF — Recommandation Surveiller Tags net_flood smtp_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 587 Chemin / cible — Service SMTP SUBMISSION Payload {wiz�:��6ʟ@;�^�[y �N�Y��L��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wiz�:��6ʟ@;�^�[y �N�Y��L��/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a35303220352e352e32204572726f723a20636f6d6d616e64206e6f74207265636f676e697a65640d0a", "emulator_response_len": 86, "bytes_in": 128, "payload_entropy": 4.857434561543816, "port_category": "well_known", "org": "Unmanaged Ltd", "service": "smtp-submission", "app_proto": "smtp-submission", "asn": 47890, "country": "RO", "dst_port": 587, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d157432ad6e6c048e9fa5882e7fe42aec61d27b3", "event_fingerprint": "46f92af6de0e45cb59b74b8735837fbfaf01a2e6", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "smtp-submission", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "12330ac2a357db26b56b2273aedaa5b7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 587, "service": "smtp-submission", "service_name": "smtp-submission", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003iz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd\u0013^\ufffd\u000f[y\u0011 \u0002\ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003iz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd\u0013^\ufffd\u000f[y\u0011 \u0002\ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003iz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd\u0013^\ufffd\u000f[y\u0011 \u0002\ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "89fa60dda8e0368badeb653e885e3c039ce1d65e", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003iz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd\u0013^\ufffd\u000f[y\u0011 \u0002\ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 587, "service": "smtp-submission", "service_label_fr": "SMTP SUBMISSION" }, "evidence_snippet": "{wiz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd^\ufffd[y \ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via SMTP SUBMISSION:587 \u00b7 (reconnaissance)", "target_port_label": "587 \u00b7 SMTP SUBMISSION", "emulator_service": "smtp-submission", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SMTP SUBMISSION \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "smtp-submission", "service_label_fr": "SMTP SUBMISSION", "dst_port": 587, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-smtp-submission", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003iz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd\u0013^\ufffd\u000f[y\u0011 \u0002\ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 587, "service": "smtp-submission", "service_label_fr": "SMTP SUBMISSION" }, "attack_vector": "port scan syn \u00b7 via SMTP SUBMISSION:587 \u00b7 (reconnaissance)", "evidence_snippet": "{wiz\ufffd:\ufffd\ufffd\ufffd6\u029f@;\ufffd^\ufffd[y \ufffdN\ufffdY\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "587 \u00b7 SMTP SUBMISSION", "emulator_service": "smtp-submission", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "smtp_submission", "service_banner": "honeypot-smtp-submission", "service_os": "linux", "dst_port": "587" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 481, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 481, "scan_velocity_ports_per_s": 158.44, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "smtp_emulated", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	5801 · TLS	tls	Scan de ports port scan syn · via TLS:5801 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5801 Chemin / cible — Service TLS Payload {w\|PM��,=2>��\5x��Js�h��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w\|PM��,=2>��\5x��Js�h��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.885836686726627, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5801, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4029cbcab0d85ee329700e48f56bc9679ac313", "event_fingerprint": "0f5859eaab7e0eedaa7acfc9548b8e043d1bae3d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "38a76317033f36a725b3b940bce14d40", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5801, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\|P\u0005M\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\b\ufffd\ufffd\u000f\\\u001c5x\ufffd\ufffdJs\ufffdh\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\|P\u0005M\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\b\ufffd\ufffd\u000f\\\u001c5x\ufffd\ufffdJs\ufffdh\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\|P\u0005M\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\b\ufffd\ufffd\u000f\\\u001c5x\ufffd\ufffdJs\ufffdh\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "85ce452c2bf1c31d1c9188e673f3187a4f04b9c2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\|P\u0005M\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\b\ufffd\ufffd\u000f\\\u001c5x\ufffd\ufffdJs\ufffdh\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5801, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\|PM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\ufffd\ufffd\\5x\ufffd\ufffdJs\ufffdh\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5801 \u00b7 (reconnaissance)", "target_port_label": "5801 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5801, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\|P\u0005M\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\b\ufffd\ufffd\u000f\\\u001c5x\ufffd\ufffdJs\ufffdh\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5801, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5801 \u00b7 (reconnaissance)", "evidence_snippet": "{w\|PM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,=2>\ufffd\ufffd\ufffd\ufffd\ufffd\\5x\ufffd\ufffdJs\ufffdh\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5801 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5801" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 482, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 482, "scan_velocity_ports_per_s": 158.47, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5920 · TLS	tls	Scan de ports port scan syn · via TLS:5920 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5920 Chemin / cible — Service TLS Payload {w;�A��D��򊱷�� c��r��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w;�A��D��򊱷�� c��r��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.873059561543816, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5920, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "9a9eecc679dca1e662d49fd0696cd176d24602a1", "event_fingerprint": "20fd3e80a4f83c4623f74e846a0fde6f0c0c7aee", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "c834e13f0f8fce46047983429d506b47", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5920, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003;\ufffd\u000fA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\t\u000bc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003;\ufffd\u000fA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\t\u000bc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003;\ufffd\u000fA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\t\u000bc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0e5010b3b8f342b886431ef1bb4178d0291849fe", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003;\ufffd\u000fA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\t\u000bc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5920, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w;\ufffdA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\tc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5920 \u00b7 (reconnaissance)", "target_port_label": "5920 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5920, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003;\ufffd\u000fA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\t\u000bc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5920, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5920 \u00b7 (reconnaissance)", "evidence_snippet": "{w;\ufffdA\ufffd\ufffdD\ufffd\ufffd\ud9eb\udc77\ufffd\ufffd\n\tc\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5920 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5920" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 483, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 483, "scan_velocity_ports_per_s": 158.49, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5918 · TLS	tls	Scan de ports port scan syn · via TLS:5918 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5918 Chemin / cible — Service TLS Payload {w�ԩ4/��Z�0�'J6��?!��# 9^hq�/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�ԩ4/��Z�0�'J6��?!��# 9^hq�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.810559561543816, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5918, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "efa8d9d8bd599806ceb29dea2cc823d7268708dc", "event_fingerprint": "d1fc741163f2438cdb7a7dd9a0a0842149f3702f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "15aa9a18e3184935354f027eda95bf8b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5918, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'\u001aJ6\ufffd\u0002\ufffd\u000e?!\ufffd\ufffd\ufffd#\n9^\u0019hq\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'\u001aJ6\ufffd\u0002\ufffd\u000e?!\ufffd\ufffd\ufffd#\n9^\u0019hq\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'\u001aJ6\ufffd\u0002\ufffd\u000e?!\ufffd\ufffd\ufffd#\n9^\u0019hq\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c4dec32f96b86dd3354159057b6dcd31fa04f77", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'\u001aJ6\ufffd\u0002\ufffd\u000e?!\ufffd\ufffd\ufffd#\n9^\u0019hq\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5918, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'J6\ufffd\ufffd?!\ufffd\ufffd\ufffd#\n9^hq\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5918 \u00b7 (reconnaissance)", "target_port_label": "5918 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5918, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'\u001aJ6\ufffd\u0002\ufffd\u000e?!\ufffd\ufffd\ufffd#\n9^\u0019hq\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5918, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5918 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\u05294\/\ufffd\ufffdZ\ufffd0\ufffd'J6\ufffd\ufffd?!\ufffd\ufffd\ufffd#\n9^hq\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5918 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5918" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 484, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 484, "scan_velocity_ports_per_s": 158.54, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	646 · TLS	tls	Scan de ports port scan syn · via TLS:646 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 646 Chemin / cible — Service TLS Payload {wm4m�\|�k��R'�NG��Pf^�iT�r\|rg^�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wm4m�\|�k��R'�NG��Pf^�iT�r\|rg^�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.7992717221840016, "port_category": "well_known", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 646, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "0b9d5122388a566320d02b3c07794dd62631aee6", "event_fingerprint": "36c93b6ede08bcd9efb281c2d1d6376253b2b055", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "1c7fc3ca227540bd1ec1a746d8d27cfd", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 646, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003m4m\ufffd\|\u0018\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg\u0007^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003m4m\ufffd\|\u0018\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg\u0007^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003m4m\ufffd\|\u0018\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg\u0007^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b9b144e6d606712ab9392050c4c83e5334fe8fe0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003m4m\ufffd\|\u0018\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg\u0007^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 646, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wm4m\ufffd\|\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg^\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:646 \u00b7 (reconnaissance)", "target_port_label": "646 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 646, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003m4m\ufffd\|\u0018\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg\u0007^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 646, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:646 \u00b7 (reconnaissance)", "evidence_snippet": "{wm4m\ufffd\|\ufffdk\ufffd\ufffd\ufffdR'\ufffdNG\ufffd\ufffd\ufffdPf^\ufffdiT\ufffdr\|rg^\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "646 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "646" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 485, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 485, "scan_velocity_ports_per_s": 158.6, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6006 · TLS	tls	Scan de ports port scan syn · via TLS:6006 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6006 Chemin / cible — Service TLS Payload {wӟ\|��n�ąJt�\4&2��۰Sq�l��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wӟ\|��n�ąJt�\4&2��۰Sq�l��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.854586686726627, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6006, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "045c9c93dbd9d4cd7a029091cd93e3d6ec27c670", "event_fingerprint": "a07b1ae9a42671f88289ad0321df1c2b75c45346", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "934613ecd33ce219cc0d60839d28f557", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6006, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04df\|\u000e\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\\u0014\u00054&\u001b2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04df\|\u000e\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\\u0014\u00054&\u001b2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04df\|\u000e\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\\u0014\u00054&\u001b2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67b47067583c245eb6df1c7a4661f518deb23972", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04df\|\u000e\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\\u0014\u00054&\u001b2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6006, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\u04df\|\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\4&2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6006 \u00b7 (reconnaissance)", "target_port_label": "6006 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6006, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04df\|\u000e\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\\u0014\u00054&\u001b2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6006, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6006 \u00b7 (reconnaissance)", "evidence_snippet": "{w\u04df\|\ufffd\ufffdn\ufffd\u0105Jt\ufffd\\4&2\ufffd\ufffd\ufffd\u06f0Sq\ufffdl\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6006 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6006" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 486, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 486, "scan_velocity_ports_per_s": 158.63, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8441 · TLS	tls	Scan de ports port scan syn · via TLS:8441 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8441 Chemin / cible — Service TLS Payload {wA��;��p�،M��SӼ��fI)Il �?�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wA��;��p�،M��SӼ��fI)Il �?�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.808218964588116, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8441, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8ec74bb28923e3c3e7f2573edaacf85035682d52", "event_fingerprint": "beff086c64e72406debd9c74708d4ff553d5cf7e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "673e7e920886cda34be2b1e98a15fb80", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8441, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\u0004\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u001b\u04fc\u0015\u0004\ufffd\ufffdfI)Il\t\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\u0004\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u001b\u04fc\u0015\u0004\ufffd\ufffdfI)Il\t\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\u0004\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u001b\u04fc\u0015\u0004\ufffd\ufffdfI)Il\t\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3099ee67b4b52677e59da77468635bf3d0d2d785", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\u0004\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u001b\u04fc\u0015\u0004\ufffd\ufffdfI)Il\t\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8441, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wA\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u04fc\ufffd\ufffdfI)Il\t\ufffd?\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8441 \u00b7 (reconnaissance)", "target_port_label": "8441 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8441, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\u0004\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u001b\u04fc\u0015\u0004\ufffd\ufffdfI)Il\t\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8441, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8441 \u00b7 (reconnaissance)", "evidence_snippet": "{wA\ufffd\ufffd;\ufffd\ufffdp\ufffd\u060cM\ufffd\ufffdS\u04fc\ufffd\ufffdfI)Il\t\ufffd?\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8441 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8441" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 487, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 487, "scan_velocity_ports_per_s": 158.67, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7080 · TLS	tls	Scan de ports port scan syn · via TLS:7080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7080 Chemin / cible — Service TLS Payload {w؆\|��Lȗ�W~��B&�ݩ�9ȇ��>o�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w؆\|��Lȗ�W~��B&�ݩ�9ȇ��>o�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.867162002933164, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1a4f7b8864c17d37faed79a97f53e0218b855b74", "event_fingerprint": "cb2002c608c5795c2ee9e361e5ef736fc787a8c8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "930bf9a0468531b53cbfaa069bcdf826", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7080, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0606\|\ufffd\u0011\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0606\|\ufffd\u0011\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0606\|\ufffd\u0011\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "853d1324a3f95e445b44064d21c5a4a1cf3075d8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0606\|\ufffd\u0011\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7080, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\u0606\|\ufffd\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7080 \u00b7 (reconnaissance)", "target_port_label": "7080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7080, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0606\|\ufffd\u0011\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7080, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7080 \u00b7 (reconnaissance)", "evidence_snippet": "{w\u0606\|\ufffd\ufffd\ufffd\ufffdL\u0217\ufffdW~\ufffd\ufffdB&\ufffd\u0769\ufffd9\u0207\ufffd\ufffd\ufffd>o\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 488, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 488, "scan_velocity_ports_per_s": 158.75, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7100 · TLS	tls	Scan de ports port scan syn · via TLS:7100 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7100 Chemin / cible — Service TLS Payload {w�޻M�� d5Ԫݔ�Xҳ��@�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�޻M�� d5Ԫݔ�Xҳ��@�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.813609245337279, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7100, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ad375f3871ce2b796eb246d226cb319889030553", "event_fingerprint": "2356a61c71781dea1e2744bc394632d7577bb96b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "309acfa3d1b88a4c6e119237e0713148", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7100, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u0011\u0004\u0010\u0004\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u0011\u0004\u0010\u0004\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u0011\u0004\u0010\u0004\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4bc3f395c906f1373acd8b71a6536f59bd15f60a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u0011\u0004\u0010\u0004\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7100, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7100 \u00b7 (reconnaissance)", "target_port_label": "7100 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7100, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u0011\u0004\u0010\u0004\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7100, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7100 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffd\u07bbM\ufffd\ufffd\ufffd\ufffd\ufffd\td5\u052a\u0754\ufffdX\u04b3\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7100 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 489, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 489, "scan_velocity_ports_per_s": 158.82, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6482 · TLS	tls	Scan de ports port scan syn · via TLS:6482 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6482 Chemin / cible — Service TLS Payload {w ��K��Ew��{�>�M��YB�Wԑ�#F�/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w ��K��Ew��{�>�M��YB�Wԑ�#F�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.81133976052905, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6482, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a5eada18f6dcd117b33375b662b10d5e82456314", "event_fingerprint": "369ec49be5db0251e59b9de4567f91703f836bf8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "c4baebfa63d03750772bb92eebecdb74", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6482, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\n\ufffd\ufffdK\ufffd\u0007\ufffdEw\ufffd\ufffd{\ufffd>\u0019\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u001b\u0003\u0511\ufffd#F\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\n\ufffd\ufffdK\ufffd\u0007\ufffdEw\ufffd\ufffd{\ufffd>\u0019\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u001b\u0003\u0511\ufffd#F\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\n\ufffd\ufffdK\ufffd\u0007\ufffdEw\ufffd\ufffd{\ufffd>\u0019\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u001b\u0003\u0511\ufffd#F\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b6ea40de22b2dabec750a33d931a62b04192e9eb", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\n\ufffd\ufffdK\ufffd\u0007\ufffdEw\ufffd\ufffd{\ufffd>\u0019\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u001b\u0003\u0511\ufffd#F\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6482, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\n\ufffd\ufffdK\ufffd\ufffdEw\ufffd\ufffd{\ufffd>\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u0511\ufffd#F\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6482 \u00b7 (reconnaissance)", "target_port_label": "6482 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6482, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\n\ufffd\ufffdK\ufffd\u0007\ufffdEw\ufffd\ufffd{\ufffd>\u0019\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u001b\u0003\u0511\ufffd#F\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6482, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6482 \u00b7 (reconnaissance)", "evidence_snippet": "{w\n\ufffd\ufffdK\ufffd\ufffdEw\ufffd\ufffd{\ufffd>\ufffdM\ufffd\ufffd\ufffdYB\ufffdW\u0511\ufffd#F\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6482 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6482" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 490, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 490, "scan_velocity_ports_per_s": 158.88, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7013 · TLS	tls	Scan de ports port scan syn · via TLS:7013 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7013 Chemin / cible — Service TLS Payload {wSiN �?�Eo�.��#�n��B ��W(�S �/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wSiN �?�Eo�.��#�n��B ��W(�S �/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.801814128115975, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 7013, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c057120bf5a9a9454104849b03659b3f2ff3e577", "event_fingerprint": "9953441b28b130ec29c8a482d26a12b46b35df0d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "ff87d55df93ce130ceed9ed66955518d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7013, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001biN\n\ufffd?\ufffdEo\ufffd.\ufffd\u0005\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW\u0003(\ufffdS\n\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001biN\n\ufffd?\ufffdEo\ufffd.\ufffd\u0005\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW\u0003(\ufffdS\n\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001biN\n\ufffd?\ufffdEo\ufffd.\ufffd\u0005\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW\u0003(\ufffdS\n\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a5ece8070641561226c0b152b2d65ff4927425c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001biN\n\ufffd?\ufffdEo\ufffd.\ufffd\u0005\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW\u0003(\ufffdS\n\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7013, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wSiN\n\ufffd?\ufffdEo\ufffd.\ufffd\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW(\ufffdS\n\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7013 \u00b7 (reconnaissance)", "target_port_label": "7013 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7013, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001biN\n\ufffd?\ufffdEo\ufffd.\ufffd\u0005\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW\u0003(\ufffdS\n\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7013, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7013 \u00b7 (reconnaissance)", "evidence_snippet": "{wSiN\n\ufffd?\ufffdEo\ufffd.\ufffd\ufffd#\ufffdn\ufffd\ufffd\ufffdB \ufffd\ufffd\ufffdW(\ufffdS\n\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7013 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7013" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 491, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 491, "scan_velocity_ports_per_s": 158.95, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6440 · TLS	tls	Scan de ports port scan syn · via TLS:6440 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6440 Chemin / cible — Service TLS Payload {w6@-��2رc;�Cx��W�L��(��F��J�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w6@-��2رc;�Cx��W�L��(��F��J�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.898412002933164, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6440, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2a7a00c6274cb853112995757d10f0c317709dc1", "event_fingerprint": "d5e6401a034774311b71daf15be49f3be8f510a3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "2a27aa1e18dff75b1087a89ebd3fd464", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6440, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036@\u000e\u0012-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\u0011\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036@\u000e\u0012-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\u0011\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036@\u000e\u0012-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\u0011\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77a787aebcda4bdfe9665ebee49327e4e4acf234", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036@\u000e\u0012-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\u0011\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6440, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w6@-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6440 \u00b7 (reconnaissance)", "target_port_label": "6440 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6440, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036@\u000e\u0012-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\u0011\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6440, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6440 \u00b7 (reconnaissance)", "evidence_snippet": "{w6@-\ufffd\ufffd\ufffd2\u0631c;\ufffdCx\ufffd\ufffdW\ufffdL\ufffd\ufffd(\ufffd\ufffd\ufffdF\ufffd\ufffdJ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6440 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6440" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 492, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 492, "scan_velocity_ports_per_s": 159.02, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 94, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8089 · SPLUNK	splunk	Scan de ports port scan syn · via SPLUNK:8089 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur SPLUNK WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8089 Chemin / cible — Service SPLUNK Payload {w�H�\| չ��.}�AS� ��h�!E�@=4x�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�H�\|չ��.}�AS��h�!E�@=4x�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.833323887112719, "port_category": "registered", "org": "Unmanaged Ltd", "service": "splunk", "app_proto": "splunk", "asn": 47890, "country": "RO", "dst_port": 8089, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "92bf0acb24ea723d3a8f128bbce21e6054cac3e3", "event_fingerprint": "cbc2550b26988a84e641846649408cb98ee64102", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "splunk", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a6ab8dc06e4de158c30e6f6c41025fb7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8089, "service": "splunk", "service_name": "splunk", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0001H\ufffd\|\u000b\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\f\u0012\ufffd\ufffdh\ufffd!E\ufffd@\u0002=4x\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0001H\ufffd\|\u000b\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\f\u0012\ufffd\ufffdh\ufffd!E\ufffd@\u0002=4x\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0001H\ufffd\|\u000b\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\f\u0012\ufffd\ufffdh\ufffd!E\ufffd@\u0002=4x\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4d5585115d099b9d1351c5717e258ef90975ec99", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0001H\ufffd\|\u000b\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\f\u0012\ufffd\ufffdh\ufffd!E\ufffd@\u0002=4x\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8089, "service": "splunk", "service_label_fr": "SPLUNK" }, "evidence_snippet": "{w\ufffdH\ufffd\|\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\ufffd\ufffdh\ufffd!E\ufffd@=4x\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)", "target_port_label": "8089 \u00b7 SPLUNK", "emulator_service": "splunk", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPLUNK \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "splunk", "service_label_fr": "SPLUNK", "dst_port": 8089, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-splunk", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0001H\ufffd\|\u000b\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\f\u0012\ufffd\ufffdh\ufffd!E\ufffd@\u0002=4x\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8089, "service": "splunk", "service_label_fr": "SPLUNK" }, "attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdH\ufffd\|\u0579\ufffd\ufffd\ufffd\ufffd.}\ufffdAS\ufffd\ufffd\ufffdh\ufffd!E\ufffd@=4x\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8089 \u00b7 SPLUNK", "emulator_service": "splunk", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "splunk", "service_banner": "honeypot-splunk", "service_os": "linux", "dst_port": "8089" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 493, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 493, "scan_velocity_ports_per_s": 159.07, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	6080 · TLS	tls	Scan de ports port scan syn · via TLS:6080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6080 Chemin / cible — Service TLS Payload {wvG�W ��b�`�I�B7 1�̻֢p�[!��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wvG�W��b�`�I�B71�̻֢p�[!��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.796264062229566, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1cc0e52054c41445bacb3735e206376ec4fe042f", "event_fingerprint": "360eea360dfa75ed989ec388e40af1e757d66d57", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "a98261273cc734ea017f9af7b2088b6f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6080, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003vG\ufffdW\u000b\ufffd\ufffdb\ufffd`\ufffdI\ufffd\u0016B7\u000b\u001e\u00031\ufffd\u033b\u05a2p\ufffd[\u0000!\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003vG\ufffdW\u000b\ufffd\ufffdb\ufffd`\ufffdI\ufffd\u0016B7\u000b\u001e\u00031\ufffd\u033b\u05a2p\ufffd[\u0000!\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003vG\ufffdW\u000b\ufffd\ufffdb\ufffd`\ufffdI\ufffd\u0016B7\u000b\u001e\u00031\ufffd\u033b\u05a2p\ufffd[\u0000!\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e902c2bb4f9236887465da47f62f29163a826479", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003vG\ufffdW\u000b\ufffd\ufffdb\ufffd`\ufffdI\ufffd\u0016B7\u000b\u001e\u00031\ufffd\u033b\u05a2p\ufffd[\u0000!\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wvG\ufffdW\ufffd\ufffdb\ufffd`\ufffdI\ufffdB71\ufffd\u033b\u05a2p\ufffd[!\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6080 \u00b7 (reconnaissance)", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6080, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003vG\ufffdW\u000b\ufffd\ufffdb\ufffd`\ufffdI\ufffd\u0016B7\u000b\u001e\u00031\ufffd\u033b\u05a2p\ufffd[\u0000!\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6080 \u00b7 (reconnaissance)", "evidence_snippet": "{wvG\ufffdW\ufffd\ufffdb\ufffd`\ufffdI\ufffdB71\ufffd\u033b\u05a2p\ufffd[!\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 494, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 494, "scan_velocity_ports_per_s": 159.12, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5620 · TLS	tls	Scan de ports port scan syn · via TLS:5620 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5620 Chemin / cible — Service TLS Payload {w@�: 8��3��Ɓ��aE��.B�v�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w@�: 8��3��Ɓ��aE��.B�v�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.84258976052905, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5620, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "e1632f6c84de8ca06ab53b88b363b25a6035089c", "event_fingerprint": "29c81abe3e9ad962014e21b2ee8b9ebb844c26d9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "2f3c6a897285d9377d8e07a6825351b5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5620, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003@\ufffd:\n8\ufffd\u001f\ufffd\ufffd3\u0003\ufffd\ufffd\u0181\ufffd\b\ufffd\ufffd\ufffd\ufffdaE\ufffd\u0015\ufffd.\u0017B\ufffdv\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003@\ufffd:\n8\ufffd\u001f\ufffd\ufffd3\u0003\ufffd\ufffd\u0181\ufffd\b\ufffd\ufffd\ufffd\ufffdaE\ufffd\u0015\ufffd.\u0017B\ufffdv\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003@\ufffd:\n8\ufffd\u001f\ufffd\ufffd3\u0003\ufffd\ufffd\u0181\ufffd\b\ufffd\ufffd\ufffd\ufffdaE\ufffd\u0015\ufffd.\u0017B\ufffdv\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5373a211908e61de902465a0c603a4c3b3ecab6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003@\ufffd:\n8\ufffd\u001f\ufffd\ufffd3\u0003\ufffd\ufffd\u0181\ufffd\b\ufffd\ufffd\ufffd\ufffdaE\ufffd\u0015\ufffd.\u0017B\ufffdv\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5620, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w@\ufffd:\n8\ufffd\ufffd\ufffd3\ufffd\ufffd\u0181\ufffd\ufffd\ufffd\ufffd\ufffdaE\ufffd\ufffd.B\ufffdv\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5620 \u00b7 (reconnaissance)", "target_port_label": "5620 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5620, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003@\ufffd:\n8\ufffd\u001f\ufffd\ufffd3\u0003\ufffd\ufffd\u0181\ufffd\b\ufffd\ufffd\ufffd\ufffdaE\ufffd\u0015\ufffd.\u0017B\ufffdv\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5620, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5620 \u00b7 (reconnaissance)", "evidence_snippet": "{w@\ufffd:\n8\ufffd\ufffd\ufffd3\ufffd\ufffd\u0181\ufffd\ufffd\ufffd\ufffd\ufffdaE\ufffd\ufffd.B\ufffdv\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5620 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5620" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 495, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 495, "scan_velocity_ports_per_s": 159.16, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	6633 · TLS	tls	Scan de ports port scan syn · via TLS:6633 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6633 Chemin / cible — Service TLS Payload {wY�2I��/�@(kg�� q1Ԉ2��/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wY�2I��/�@(kg�� q1Ԉ2��/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.792086686726627, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6633, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c2207b6fd183208bd058bddc787a1fc1296ffe27", "event_fingerprint": "87d9627f6df1fee3c6a6dd162fb69e9c58aff41b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "8569ed8b62ba5b63d43f9ace5b69d589", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6633, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001fY\u0002\ufffd2I\ufffd\u0014\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd \u0002q1\u05082\ufffd\u001f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001fY\u0002\ufffd2I\ufffd\u0014\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd \u0002q1\u05082\ufffd\u001f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001fY\u0002\ufffd2I\ufffd\u0014\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd \u0002q1\u05082\ufffd\u001f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f408e8192a7ff3689a93ffa345cf1fd578f9e39d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001fY\u0002\ufffd2I\ufffd\u0014\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd \u0002q1\u05082\ufffd\u001f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6633, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wY\ufffd2I\ufffd\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd q1\u05082\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6633 \u00b7 (reconnaissance)", "target_port_label": "6633 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6633, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001fY\u0002\ufffd2I\ufffd\u0014\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd \u0002q1\u05082\ufffd\u001f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6633, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6633 \u00b7 (reconnaissance)", "evidence_snippet": "{wY\ufffd2I\ufffd\ufffd\ufffd\/\ufffd@(kg\ufffd\ufffd\ufffd q1\u05082\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6633 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6633" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 496, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 496, "scan_velocity_ports_per_s": 159.19, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8453 · TLS	tls	Scan de ports port scan syn · via TLS:8453 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8453 Chemin / cible — Service TLS Payload {w�Ft'[훴Ybf��Uـ�Tie�Nk+�J�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w�Ft'[훴Ybf��Uـ�Tie�Nk+�J�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.821528769891415, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 8453, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8cda642cbfa8f99c5c885b2a261ec7a6a40ab6c7", "event_fingerprint": "ca2566d6e501d14ff449a256c0c06c29b66210b8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "3db9b8673ad065dc011ca7a32d1025f9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8453, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0012\u0012\u0640\ufffdT\u0016ie\u000e\u0001\ufffdNk+\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0012\u0012\u0640\ufffdT\u0016ie\u000e\u0001\ufffdNk+\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0012\u0012\u0640\ufffdT\u0016ie\u000e\u0001\ufffdNk+\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "03303f647ce5596e8993902be43efda4eda884fb", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0012\u0012\u0640\ufffdT\u0016ie\u000e\u0001\ufffdNk+\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8453, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0640\ufffdTie\ufffdNk+\ufffdJ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8453 \u00b7 (reconnaissance)", "target_port_label": "8453 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8453, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0012\u0012\u0640\ufffdT\u0016ie\u000e\u0001\ufffdNk+\ufffdJ\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8453, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8453 \u00b7 (reconnaissance)", "evidence_snippet": "{w\ufffdFt'[\ud6f4Ybf\ufffd\ufffd\ufffdU\u0640\ufffdTie\ufffdNk+\ufffdJ\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8453 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8453" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 497, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 497, "scan_velocity_ports_per_s": 159.24, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5910 · TLS	tls	Scan de ports port scan syn · via TLS:5910 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5910 Chemin / cible — Service TLS Payload {wɓyT�N�Fñ��x��e�a�IK�/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wɓyT�N�Fñ��x��e�a�IK�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.821528769891415, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5910, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "66809fa8d8143e27664f876d9a4297f33a5b7258", "event_fingerprint": "2b072cfa8bb177ed3014b45cfb2d139ab09a9a6b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "d61ee945d39febb86d3213ef4c643424", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5910, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0253\u0007yT\u0001\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0253\u0007yT\u0001\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0253\u0007yT\u0001\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c9dc0c7c125aa4f017e43d855ddc2977ab86c6a1", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0253\u0007yT\u0001\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5910, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w\u0253yT\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5910 \u00b7 (reconnaissance)", "target_port_label": "5910 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5910, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0253\u0007yT\u0001\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5910, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5910 \u00b7 (reconnaissance)", "evidence_snippet": "{w\u0253yT\ufffdN\ufffdF\u00f1\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffda\ufffdIK\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5910 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5910" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 498, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 498, "scan_velocity_ports_per_s": 159.3, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 95, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	8084 · HTTP ALT 8084	http-alt-8084	Scan de ports port scan syn · via HTTP ALT 8084:8084 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur HTTP-ALT-8084 WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8084 Chemin / cible — Service HTTP ALT 8084 Payload {wNlA��`�ŔB�q�݊^��Ã��v <��/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wNlA��`�ŔB�q�݊^��Ã��v <��/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.873059561543816, "port_category": "registered", "org": "Unmanaged Ltd", "service": "http-alt-8084", "app_proto": "http-alt-8084", "asn": 47890, "country": "RO", "dst_port": 8084, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3d5024343fa7424304d8f83670ab52c567803d23", "event_fingerprint": "9218c3a6103020d7b5cb681eb016f90f0e1a1b1b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http-alt-8084", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5db7a1731f8a0a8943ed6fe044bd162b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8084, "service": "http-alt-8084", "service_name": "http-alt-8084", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003NlA\ufffd\ufffd`\u0007\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n\u0013<\ufffd\u0019\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003NlA\ufffd\ufffd`\u0007\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n\u0013<\ufffd\u0019\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003NlA\ufffd\ufffd`\u0007\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n\u0013<\ufffd\u0019\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eea6f17b93707bb572aa543f4ce193ef229ead01", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003NlA\ufffd\ufffd`\u0007\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n\u0013<\ufffd\u0019\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8084, "service": "http-alt-8084", "service_label_fr": "HTTP ALT 8084" }, "evidence_snippet": "{wNlA\ufffd\ufffd`\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n<\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)", "target_port_label": "8084 \u00b7 HTTP ALT 8084", "emulator_service": "http-alt-8084", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8084 \u2014 multi-protocole (96 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8084", "service_label_fr": "HTTP ALT 8084", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8084", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003NlA\ufffd\ufffd`\u0007\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n\u0013<\ufffd\u0019\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 8084, "service": "http-alt-8084", "service_label_fr": "HTTP ALT 8084" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)", "evidence_snippet": "{wNlA\ufffd\ufffd`\ufffd\u0154B\ufffdq\ufffd\u074a^\ufffd\ufffd\u00c3\ufffd\ufffd\ufffdv\n<\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "8084 \u00b7 HTTP ALT 8084", "emulator_service": "http-alt-8084", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8084", "service_banner": "honeypot-http-alt-8084", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 499, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 499, "scan_velocity_ports_per_s": 159.37, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 96, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	5601 · KIBANA	kibana	Scan de ports port scan syn · via KIBANA:5601 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur KIBANA WAF — Recommandation Surveiller Tags kibana_emulated net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5601 Chemin / cible — Service KIBANA Payload {wO�;�R`��g�X��`��}��0C��-ɇ�h�/�+�� /5� 4 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wO�;�R`��g�X��`��}��0C��-ɇ�h�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "bytes_in": 128, "payload_entropy": 4.798764444322512, "port_category": "registered", "org": "Unmanaged Ltd", "service": "kibana", "app_proto": "kibana", "asn": 47890, "country": "RO", "dst_port": 5601, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a244e53646a4fee15f5e8cf1dabe8740245352d3", "event_fingerprint": "cec7fb1fde7a0a74c4b6657abead7d0f83a4e3ed", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "kibana", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4fe3fc7d08e83dbfa9d316243a2c2b98", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5601, "service": "kibana", "service_name": "kibana", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003O\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\u0004\ufffd}\ufffd\ufffd0C\ufffd\ufffd\b-\u0247\ufffdh\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003O\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\u0004\ufffd}\ufffd\ufffd0C\ufffd\ufffd\b-\u0247\ufffdh\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003O\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\u0004\ufffd}\ufffd\ufffd0C\ufffd\ufffd\b-\u0247\ufffdh\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "492e1e101594bba1bd7012265fd8118416238738", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003O\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\u0004\ufffd}\ufffd\ufffd0C\ufffd\ufffd\b-\u0247\ufffdh\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5601, "service": "kibana", "service_label_fr": "KIBANA" }, "evidence_snippet": "{wO\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\ufffd}\ufffd\ufffd0C\ufffd\ufffd-\u0247\ufffdh\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via KIBANA:5601 \u00b7 (reconnaissance)", "target_port_label": "5601 \u00b7 KIBANA", "emulator_service": "kibana", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KIBANA \u2014 multi-protocole (97 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "kibana", "service_label_fr": "KIBANA", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kibana", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003O\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\u0004\ufffd}\ufffd\ufffd0C\ufffd\ufffd\b-\u0247\ufffdh\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5601, "service": "kibana", "service_label_fr": "KIBANA" }, "attack_vector": "port scan syn \u00b7 via KIBANA:5601 \u00b7 (reconnaissance)", "evidence_snippet": "{wO\ufffd;\ufffdR`\ufffd\ufffdg\ufffdX\ufffd\ufffd\ufffd`\ufffd\ufffd}\ufffd\ufffd0C\ufffd\ufffd-\u0247\ufffdh\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5601 \u00b7 KIBANA", "emulator_service": "kibana", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kibana", "service_banner": "honeypot-kibana", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 500, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 500, "scan_velocity_ports_per_s": 159.44, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 97, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "kibana_emulated", "net_flood", "tls_clienthello" ] }
26/07/2026 20:36:22 UTC	TCP	6688 · TLS	tls	Scan de ports port scan syn · via TLS:6688 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6688 Chemin / cible — Service TLS Payload {w+��p��#;�69a� I��b�[�^r1+ ��K�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {w+��p��#;�69a� I��b�[�^r1+ ��K�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.8148967221840016, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 6688, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "45dfb52864fca066b169695be64fea29e4b50484", "event_fingerprint": "7a3ef038285d1620090efa1f52252efe2140d039", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "14e00c35ad7448350953912fd084cee8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 6688, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003+\u0010\ufffd\ufffdp\ufffd\ufffd#;\ufffd69\u0013a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003+\u0010\ufffd\ufffdp\ufffd\ufffd#;\ufffd69\u0013a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003+\u0010\ufffd\ufffdp\ufffd\ufffd#;\ufffd69\u0013a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a527f688e13658127c5e3cce990f20816d2ed60", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003+\u0010\ufffd\ufffdp\ufffd\ufffd#;\ufffd69\u0013a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6688, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{w+\ufffd\ufffdp\ufffd\ufffd#;\ufffd69a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6688 \u00b7 (reconnaissance)", "target_port_label": "6688 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6688, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003+\u0010\ufffd\ufffdp\ufffd\ufffd#;\ufffd69\u0013a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 6688, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6688 \u00b7 (reconnaissance)", "evidence_snippet": "{w+\ufffd\ufffdp\ufffd\ufffd#;\ufffd69a\ufffd\nI\ufffd\ufffdb\ufffd[\ufffd^r1+ \ufffd\ufffd\ufffdK\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "6688 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6688" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 501, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 501, "scan_velocity_ports_per_s": 159.5, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 97, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	5998 · TLS	tls	Scan de ports port scan syn · via TLS:5998 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5998 Chemin / cible — Service TLS Payload {wB��q]��R39�o�T��yg">�2�R�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {wB��q]��R39�o�T��yg">�2�R�/�+�� /5� 4 � Meta JSON brut { "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 128, "payload_entropy": 4.821067201918398, "port_category": "registered", "org": "Unmanaged Ltd", "service": "tls", "app_proto": "tls", "asn": 47890, "country": "RO", "dst_port": 5998, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "01a768786ef8ef0e74b7a6782a3f168fd1580613", "event_fingerprint": "6f023040f0162ebcb46f14831d1756e2168892bf", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "payload_hash": "52c937aab8e02c260b01c276dc1ea9fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5998, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003B\ufffd\u0011\ufffd\ufffdq]\ufffd\u0017\ufffd\ufffd\ufffdR\u000739\ufffdo\ufffdT\ufffd\ufffdyg\"\u0019>\ufffd2\ufffd\u0003R\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003B\ufffd\u0011\ufffd\ufffdq]\ufffd\u0017\ufffd\ufffd\ufffdR\u000739\ufffdo\ufffdT\ufffd\ufffdyg\"\u0019>\ufffd2\ufffd\u0003R\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003B\ufffd\u0011\ufffd\ufffdq]\ufffd\u0017\ufffd\ufffd\ufffdR\u000739\ufffdo\ufffdT\ufffd\ufffdyg\"\u0019>\ufffd2\ufffd\u0003R\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a82b51c96c851555188da6ae53b9cfcfbb42662", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003B\ufffd\u0011\ufffd\ufffdq]\ufffd\u0017\ufffd\ufffd\ufffdR\u000739\ufffdo\ufffdT\ufffd\ufffdyg\"\u0019>\ufffd2\ufffd\u0003R\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5998, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "{wB\ufffd\ufffd\ufffdq]\ufffd\ufffd\ufffd\ufffdR39\ufffdo\ufffdT\ufffd\ufffdyg\">\ufffd2\ufffdR\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5998 \u00b7 (reconnaissance)", "target_port_label": "5998 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5998, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003B\ufffd\u0011\ufffd\ufffdq]\ufffd\u0017\ufffd\ufffd\ufffdR\u000739\ufffdo\ufffdT\ufffd\ufffdyg\"\u0019>\ufffd2\ufffd\u0003R\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 5998, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5998 \u00b7 (reconnaissance)", "evidence_snippet": "{wB\ufffd\ufffd\ufffdq]\ufffd\ufffd\ufffd\ufffdR39\ufffdo\ufffdT\ufffd\ufffdyg\">\ufffd2\ufffdR\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "5998 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5998" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 502, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 502, "scan_velocity_ports_per_s": 159.57, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 97, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 20:36:22 UTC	TCP	7005 · WEBLOGIC CLUSTER	weblogic-cluster	Scan de ports port scan syn · via WEBLOGIC CLUSTER:7005 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cba7f34191ef2379 Émulateur WEBLOGIC-CLUSTER WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7005 Chemin / cible — Service WEBLOGIC CLUSTER Payload {ww��R��E��t̛#��8�:�2�+�/�+�� /5� 4 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) {ww��R��E��t̛#��8�:�2�+�/�+�� /5� 4 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 128, "payload_entropy": 4.841809561543816, "port_category": "registered", "org": "Unmanaged Ltd", "service": "weblogic-cluster", "app_proto": "weblogic-cluster", "asn": 47890, "country": "RO", "dst_port": 7005, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "a4f137b4ae5d6153fd749f550e3ed88333e2a51c", "event_fingerprint": "eddb7c0550475da35c187102a3637f6406632c48", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "weblogic-cluster", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "RO", "asn": 47890, "org": "Unmanaged Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c79f5e991f3309eab2ad85dbed96ef71", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "cba7f34191ef2379c1325641f6c6c4f4", "ja4": "a3a5f53d3656a0df675e8aa020d5979e", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e", "tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 13, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7005, "service": "weblogic-cluster", "service_name": "weblogic-cluster", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003w\ufffd\ufffd\ufffd\ufffd\u0017\ufffdR\ufffd\ufffdE\ufffd\u0014\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd\u00022\ufffd+\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003w\ufffd\ufffd\ufffd\ufffd\u0017\ufffdR\ufffd\ufffdE\ufffd\u0014\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd\u00022\ufffd+\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003w\ufffd\ufffd\ufffd\ufffd\u0017\ufffdR\ufffd\ufffdE\ufffd\u0014\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd\u00022\ufffd+\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bdf6c68e1181b19c997d86a5c1de7bb0560a54d0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003w\ufffd\ufffd\ufffd\ufffd\u0017\ufffdR\ufffd\ufffdE\ufffd\u0014\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd\u00022\ufffd+\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "evidence_snippet": "{ww\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd2\ufffd+\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "attack_vector": "port scan syn \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (reconnaissance)", "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBLOGIC CLUSTER \u2014 multi-protocole (97 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic-cluster", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003w\ufffd\ufffd\ufffd\ufffd\u0017\ufffdR\ufffd\ufffdE\ufffd\u0014\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd\u00022\ufffd+\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4", "tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e", "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "attack_vector": "port scan syn \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (reconnaissance)", "evidence_snippet": "{ww\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdt\u031b#\ufffd\ufffd8\ufffd:\ufffd2\ufffd+\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd", "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic_cluster", "service_banner": "honeypot-weblogic-cluster", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 503, "port_scan_ports_sample": [ 11, 13, 15, 17, 19, 26, 37, 43, 49, 85, 104, 106, 111, 119, 122, 137 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 503, "scan_velocity_ports_per_s": 159.63, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "game", "iot", "medical", "ot", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 97, "multi_protocol_sample": [ "aim", "ajp", "aws-ecs-agent", "bgp", "cassandra-jmx", "chargen", "cics-alt", "cloudflare-tunnel" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tls_clienthello" ] }

80.94.92.13

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence