|
|
TCP |
5503 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5503 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5503
Chemin / cible
—
Service
TLS
Payload
{ w)�9��?��3��v�LF�&��WSNh�#�壉 �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w)�9��?��3��v�LF�&��WSNh�#�壉 �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.858676328502067,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5503,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7936a3b2849bb61dca2b3c17e36e4d792163834e",
"event_fingerprint": "ca0487cdb88f8abe538154a90724162ec8011b8a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "b45699dfd940f67a72d8abb7a39d1d48",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5503,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)\ufffd9\ufffd\ufffd?\ufffd\ufffd\u00113\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\u001a\ufffd\u0001WSNh\ufffd#\ufffd\u58c9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)\ufffd9\ufffd\ufffd?\ufffd\ufffd\u00113\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\u001a\ufffd\u0001WSNh\ufffd#\ufffd\u58c9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)\ufffd9\ufffd\ufffd?\ufffd\ufffd\u00113\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\u001a\ufffd\u0001WSNh\ufffd#\ufffd\u58c9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f023706a772b7e718e0477a46cca34038b1a1c22",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)\ufffd9\ufffd\ufffd?\ufffd\ufffd\u00113\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\u001a\ufffd\u0001WSNh\ufffd#\ufffd\u58c9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5503,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w)\ufffd9\ufffd\ufffd?\ufffd\ufffd3\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\ufffdWSNh\ufffd#\ufffd\u58c9\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5503 \u00b7 (reconnaissance)",
"target_port_label": "5503 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5503,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)\ufffd9\ufffd\ufffd?\ufffd\ufffd\u00113\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\u001a\ufffd\u0001WSNh\ufffd#\ufffd\u58c9\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5503,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5503 \u00b7 (reconnaissance)",
"evidence_snippet": "{w)\ufffd9\ufffd\ufffd?\ufffd\ufffd3\ufffd\ufffdv\ufffdLF\ufffd&\ufffd\ufffdWSNh\ufffd#\ufffd\u58c9\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5503 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5503"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 504,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
85,
104,
106,
111,
119,
122,
137
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 504,
"scan_velocity_ports_per_s": 159.69,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6380 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:6380 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6380
Chemin / cible
—
Service
TLS
Payload
{ w� "�u�&Q�(�E �� %Q k�a� �La �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�
"�u�&Q�(�E �� %Q k�a� �La �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.779309561543816,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 6380,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c4f0a949e8cbc3b5b496a7d9c9329a4c343865cf",
"event_fingerprint": "816945359aa3148756cb914e3c000be09ee18ecd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "b0d5f942e98e07d65f2a0892a345e63f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 6380,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\r\"\ufffdu\u0012\ufffd&Q\ufffd(\ufffdE\u001d\ufffd\ufffd\u0018\u0019\f%\u0002Q\fk\ufffda\ufffd\t\ufffdLa\u0015\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\r\"\ufffdu\u0012\ufffd&Q\ufffd(\ufffdE\u001d\ufffd\ufffd\u0018\u0019\f%\u0002Q\fk\ufffda\ufffd\t\ufffdLa\u0015\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\r\"\ufffdu\u0012\ufffd&Q\ufffd(\ufffdE\u001d\ufffd\ufffd\u0018\u0019\f%\u0002Q\fk\ufffda\ufffd\t\ufffdLa\u0015\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f250b383f50c4775b13f9d2534fd14b1bdd5fdd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\r\"\ufffdu\u0012\ufffd&Q\ufffd(\ufffdE\u001d\ufffd\ufffd\u0018\u0019\f%\u0002Q\fk\ufffda\ufffd\t\ufffdLa\u0015\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 6380,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\r\"\ufffdu\ufffd&Q\ufffd(\ufffdE\ufffd\ufffd%Qk\ufffda\ufffd\t\ufffdLa\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:6380 \u00b7 (reconnaissance)",
"target_port_label": "6380 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6380,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\r\"\ufffdu\u0012\ufffd&Q\ufffd(\ufffdE\u001d\ufffd\ufffd\u0018\u0019\f%\u0002Q\fk\ufffda\ufffd\t\ufffdLa\u0015\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 6380,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:6380 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\r\"\ufffdu\ufffd&Q\ufffd(\ufffdE\ufffd\ufffd%Qk\ufffda\ufffd\t\ufffdLa\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "6380 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6380"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 505,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
85,
104,
106,
111,
119,
122,
137
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 505,
"scan_velocity_ports_per_s": 159.73,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
83 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:83 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
83
Chemin / cible
—
Service
TLS
Payload
{ wͼ��.R� ���ӭ� �E -�y��f2��� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wͼ��.R�
���ӭ� �E
-�y��f2��� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.8241168857118595,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 83,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3457883ab4edca17b0c8d5149e6b5f8032fba09e",
"event_fingerprint": "4df8611a0a9b2dafcd666f7f0e74a1ff160efb4a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "290de360dc75a3c76494c6ce05b16cbe",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 83,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u037c\ufffd\ufffd.R\ufffd\r\u0004\ufffd\ufffd\u0004\ufffd\u04ed\ufffd\u001f\ufffdE\r-\ufffdy\ufffd\u0003\ufffdf2\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u037c\ufffd\ufffd.R\ufffd\r\u0004\ufffd\ufffd\u0004\ufffd\u04ed\ufffd\u001f\ufffdE\r-\ufffdy\ufffd\u0003\ufffdf2\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u037c\ufffd\ufffd.R\ufffd\r\u0004\ufffd\ufffd\u0004\ufffd\u04ed\ufffd\u001f\ufffdE\r-\ufffdy\ufffd\u0003\ufffdf2\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3dd25434e606df3139c4e0d88df9e331d745df3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u037c\ufffd\ufffd.R\ufffd\r\u0004\ufffd\ufffd\u0004\ufffd\u04ed\ufffd\u001f\ufffdE\r-\ufffdy\ufffd\u0003\ufffdf2\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 83,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\u037c\ufffd\ufffd.R\ufffd\r\ufffd\ufffd\ufffd\u04ed\ufffd\ufffdE\r-\ufffdy\ufffd\ufffdf2\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:83 \u00b7 (reconnaissance)",
"target_port_label": "83 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 83,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u037c\ufffd\ufffd.R\ufffd\r\u0004\ufffd\ufffd\u0004\ufffd\u04ed\ufffd\u001f\ufffdE\r-\ufffdy\ufffd\u0003\ufffdf2\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 83,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:83 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\u037c\ufffd\ufffd.R\ufffd\r\ufffd\ufffd\ufffd\u04ed\ufffd\ufffdE\r-\ufffdy\ufffd\ufffdf2\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "83 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "83"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 506,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 506,
"scan_velocity_ports_per_s": 159.79,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
666 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:666 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
666
Chemin / cible
—
Service
TLS
Payload
{ w��� HJ5)���^J1YP^�����+��� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��� HJ5)���^J1YP^�����+��� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.789037002933164,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 666,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8c89f606496a7bba9bf50ef8e2d26add1b8c5054",
"event_fingerprint": "31c3680bf19c83a059d22db9172f18ac8b1883b7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "ceec7d4404c0e040f8eeda1752a1442f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 666,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\fHJ5)\ufffd\ufffd\u0013\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\u0004\b\ufffd+\ufffd\b\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\fHJ5)\ufffd\ufffd\u0013\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\u0004\b\ufffd+\ufffd\b\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\fHJ5)\ufffd\ufffd\u0013\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\u0004\b\ufffd+\ufffd\b\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "152f8e3c44d335951e7af45d454aa41f0a2e8c8e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\fHJ5)\ufffd\ufffd\u0013\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\u0004\b\ufffd+\ufffd\b\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 666,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffdHJ5)\ufffd\ufffd\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:666 \u00b7 (reconnaissance)",
"target_port_label": "666 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 666,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\fHJ5)\ufffd\ufffd\u0013\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\u0004\b\ufffd+\ufffd\b\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 666,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:666 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffdHJ5)\ufffd\ufffd\ufffd^\u00adJ1YP^\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "666 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 507,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 507,
"scan_velocity_ports_per_s": 159.85,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8102 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8102 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8102
Chemin / cible
—
Service
TLS
Payload
{ wD#u��S�] K_p ��Q�a���S,�w� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wD#u��S�]
K_p ��Q�a���S,�w� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.749347038390539,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 8102,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f73b419406322437bab3f5db0e3a76bd8623429e",
"event_fingerprint": "7f43edbb50f595fbc4ace5b5051126624dedae71",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "f1dd8fa220504bec1a2341d6a5460e46",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8102,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003D#u\ufffd\u000f\ufffdS\u0014\ufffd]\nK_p\u001c\ufffd\ufffd\bQ\ufffd\u0003a\ufffd\ufffd\ufffdS,\ufffd\u0002w\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003D#u\ufffd\u000f\ufffdS\u0014\ufffd]\nK_p\u001c\ufffd\ufffd\bQ\ufffd\u0003a\ufffd\ufffd\ufffdS,\ufffd\u0002w\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003D#u\ufffd\u000f\ufffdS\u0014\ufffd]\nK_p\u001c\ufffd\ufffd\bQ\ufffd\u0003a\ufffd\ufffd\ufffdS,\ufffd\u0002w\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98490385718cee34840ee7c2fad7825a46c54b95",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003D#u\ufffd\u000f\ufffdS\u0014\ufffd]\nK_p\u001c\ufffd\ufffd\bQ\ufffd\u0003a\ufffd\ufffd\ufffdS,\ufffd\u0002w\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 8102,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{wD#u\ufffd\ufffdS\ufffd]\nK_p\ufffd\ufffdQ\ufffda\ufffd\ufffd\ufffdS,\ufffdw\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:8102 \u00b7 (reconnaissance)",
"target_port_label": "8102 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8102,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003D#u\ufffd\u000f\ufffdS\u0014\ufffd]\nK_p\u001c\ufffd\ufffd\bQ\ufffd\u0003a\ufffd\ufffd\ufffdS,\ufffd\u0002w\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 8102,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8102 \u00b7 (reconnaissance)",
"evidence_snippet": "{wD#u\ufffd\ufffdS\ufffd]\nK_p\ufffd\ufffdQ\ufffda\ufffd\ufffd\ufffdS,\ufffdw\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "8102 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8102"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 508,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 508,
"scan_velocity_ports_per_s": 159.89,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5904 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5904 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5904
Chemin / cible
—
Service
TLS
Payload
{ w�ʟ�h� HB�ve)�r�� _�r����w��� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�ʟ�h� HB�ve)�r�� _�r����w��� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.8359120029331635,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5904,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "68a3e1d600560a56f0260e59cf96705c164258e0",
"event_fingerprint": "5eb8f4cca50f78e5545bb1b775a489d72e0af37d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "866988cf3a445f723c189e02efa2c724",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5904,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u029f\ufffdh\ufffd H\u0015B\u0016\ufffdve)\ufffdr\ufffd\ufffd\u000b_\ufffdr\ufffd\ufffd\u0007\ufffd\ufffdw\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u029f\ufffdh\ufffd H\u0015B\u0016\ufffdve)\ufffdr\ufffd\ufffd\u000b_\ufffdr\ufffd\ufffd\u0007\ufffd\ufffdw\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u029f\ufffdh\ufffd H\u0015B\u0016\ufffdve)\ufffdr\ufffd\ufffd\u000b_\ufffdr\ufffd\ufffd\u0007\ufffd\ufffdw\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "247954ab395be5d80eae79478b9ac8c4f022f433",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u029f\ufffdh\ufffd H\u0015B\u0016\ufffdve)\ufffdr\ufffd\ufffd\u000b_\ufffdr\ufffd\ufffd\u0007\ufffd\ufffdw\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5904,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\u029f\ufffdh\ufffd HB\ufffdve)\ufffdr\ufffd\ufffd_\ufffdr\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5904 \u00b7 (reconnaissance)",
"target_port_label": "5904 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5904,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u029f\ufffdh\ufffd H\u0015B\u0016\ufffdve)\ufffdr\ufffd\ufffd\u000b_\ufffdr\ufffd\ufffd\u0007\ufffd\ufffdw\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5904,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5904 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\u029f\ufffdh\ufffd HB\ufffdve)\ufffdr\ufffd\ufffd_\ufffdr\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5904 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5904"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 509,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 509,
"scan_velocity_ports_per_s": 159.91,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5658 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5658 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5658
Chemin / cible
—
Service
TLS
Payload
{ w��������#`��_ ���Zw�H��; ��?h �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��������#`��_ ���Zw�H��;
��?h �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.832631421854986,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5658,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "79f099d13022c9da39b483c7ba79bb32ec84fe5f",
"event_fingerprint": "6d66722e6114644f8879f8d99f3aadcedcf97911",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0f1eca20baf178bc70d2c35713dbbe2e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5658,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\u0011`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\u0000\ufffd\ufffd?h\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\u0011`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\u0000\ufffd\ufffd?h\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\u0011`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\u0000\ufffd\ufffd?h\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e715e1fdd3f4f828f3949b606762ee70300cf2d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\u0011`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\u0000\ufffd\ufffd?h\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5658,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\ufffd\ufffd?h\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5658 \u00b7 (reconnaissance)",
"target_port_label": "5658 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5658,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\u0011`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\u0000\ufffd\ufffd?h\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5658,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5658 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#`\ufffd\ufffd_ \ufffd\ufffd\ufffdZw\ufffdH\ufffd\ufffd;\r\ufffd\ufffd?h\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5658 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5658"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 510,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 510,
"scan_velocity_ports_per_s": 159.93,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5640 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5640 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5640
Chemin / cible
—
Service
TLS
Payload
{ w��� ��Ա��W��%�^>j� � ���� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��� ��Ա��W��%�^>j� � ���� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.898412002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5640,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5d5fe2892da36c7d4a812ed94c594c4ad63ba73e",
"event_fingerprint": "6b156ecf7d91962aef6269a295dcb0534f98f763",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "04ba8f10965229b06a6acd1d46fbb17d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5640,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffd\u0014W\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\u001e\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffd\u0014W\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\u001e\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffd\u0014W\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\u001e\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f6b208218997e6b00b69218e268dea34fae6506",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffd\u0014W\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\u001e\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5640,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffdW\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5640 \u00b7 (reconnaissance)",
"target_port_label": "5640 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5640,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffd\u0014W\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\u001e\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5640,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5640 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd \ufffd\ufffd\u0531\ufffd\ufffdW\ufffd\ufffd%\ufffd^>j\ufffd \ufffd\ufffd\ufffd\ud8a7\udf28\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5640 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5640"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 511,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 511,
"scan_velocity_ports_per_s": 159.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5906 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5906 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5906
Chemin / cible
—
Service
TLS
Payload
{ weȁvg�c"�#$�7+6=�hOq[&,��?��X�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ weȁvg�c"�#$�7+6=�hOq[&,��?��X�� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.904309561543816,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5906,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9e30fc28f2139ad84121230d4383d4fd386764e6",
"event_fingerprint": "71ce414e3c81d073c00213df51f4b69331a47596",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "c8f789b1488a2f7c7292f03c0dadb21a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5906,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003e\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\u0002\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003e\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\u0002\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003e\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\u0002\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "04042edaa2eb37e6b5e38c04ee933f94379be5a6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003e\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\u0002\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5906,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{we\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5906 \u00b7 (reconnaissance)",
"target_port_label": "5906 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5906,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003e\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\u0002\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5906,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5906 \u00b7 (reconnaissance)",
"evidence_snippet": "{we\u0201vg\ufffdc\"\ufffd#$\ufffd7+6=\ufffdhOq[&,\ufffd\ufffd?\ufffd\ufffdX\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5906 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5906"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 512,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 512,
"scan_velocity_ports_per_s": 160.01,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5915 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5915 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5915
Chemin / cible
—
Service
TLS
Payload
{ w�ڿFy���i3�kh �9f����)(�4f� n� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�ڿFy���i3�kh �9f����)(�4f�
n� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.7895442807946536,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5915,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "eea6c9b2f0261fb8a060f79bf7ba613faed5642a",
"event_fingerprint": "f008ecf94ae9ed2b068931baf61bc6ab90ec2535",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0c94e3f170d8770bbf03df28572bad9c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5915,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0014\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\u001f\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\u0011\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0014\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\u001f\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\u0011\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0014\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\u001f\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\u0011\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e87e55d71f834c77d780fb6bd8471885d949a5eb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0014\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\u001f\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\u0011\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5915,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5915 \u00b7 (reconnaissance)",
"target_port_label": "5915 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5915,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0014\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\u001f\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\u0011\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5915,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5915 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\u06bfFy\ufffd\ufffd\ufffdi3\ufffdkh\ufffd9f\ufffd\ufffd\ufffd\ufffd)(\ufffd4f\ufffd\nn\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5915 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5915"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 513,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 513,
"scan_velocity_ports_per_s": 160.07,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5907 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5907 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5907
Chemin / cible
—
Service
TLS
Payload
{ w��~��U0Tx[d,�'��$Ui,6L�̷& �/�6 �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��~��U0Tx[d,�'��$Ui,6L�̷&
�/�6 �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.851537002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 5907,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ebb53af61a6851f2e6a3f857e04b4cde6a530dfc",
"event_fingerprint": "15adbb0bcbfae8ad414a541388fd62db8dd24902",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "8f367f782e96a4d429c5061ef038b170",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5907,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9557b8ecdde3c383c21efa95f8d8d65ea33a1d74",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5907,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5907 \u00b7 (reconnaissance)",
"target_port_label": "5907 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5907,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5907,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5907 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd~\ufffd\ufffdU0Tx[d,\ufffd'\ufffd\ufffd$Ui,6L\ufffd\u0337&\n\ufffd\/\ufffd6\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5907 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5907"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 514,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 514,
"scan_velocity_ports_per_s": 160.14,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5222 · XMPP
|
xmpp
|
Scan de ports
port scan syn · via XMPP:5222 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
XMPP
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
xmpp_emulated
xmpp_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5222
Chemin / cible
—
Service
XMPP
Payload
{ w�}��\� 촬�3F� �VSJ�Yj�S+��$�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�}��\� 촬�3F� �VSJ�Yj�S+��$�� �/�+���� ��
/ 5�
4
�
Requête brute (extrait)
{ w�}��\� 촬�3F� �VSJ�Yj�S+��$�� �/�+���� �� / 5� 4 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3c3f786d6c2076657273696f6e3d22312e30223f3e3c73747265616d3a73747265616d20786d6c6e733d226a61626265723a636c69656e74222066726f6d3d22686f6e6579706f742e6c6f63616c222069643d22687031223e3c73747265616d3a66656174757265733e3c6d656368616e69736d7320786d6c6e733d2275726e",
"emulator_response_len": 218,
"bytes_in": 135,
"payload_entropy": 4.889673139036718,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "xmpp",
"app_proto": "xmpp",
"asn": 47890,
"country": "RO",
"dst_port": 5222,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fc967b78133a936b59860660328a34a9b71efe9c",
"event_fingerprint": "613a94fe0ef7ee7b248f200dcc6e673ce84cc198",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "xmpp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cb28752185c5495c10595aac5877cb45",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5222,
"service": "xmpp",
"service_name": "xmpp",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd}\ufffd\ufffd\\\ufffd\u001d\ucd2c\ufffd3\u0014F\ufffd\u001b\u001d\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd}\ufffd\ufffd\\\ufffd\u001d\ucd2c\ufffd3\u0014F\ufffd\u001b\u001d\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000\u0015\u0003\u0001\u0000\u0002\u0002\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd}\ufffd\ufffd\\\ufffd\u001d\ucd2c\ufffd3\u0014F\ufffd\u001b\u001d\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "028fab0c73993012a996f995c5e0e253283f6457",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd}\ufffd\ufffd\\\ufffd\u001d\ucd2c\ufffd3\u0014F\ufffd\u001b\u001d\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5222,
"service": "xmpp",
"service_label_fr": "XMPP"
},
"evidence_snippet": "{w\ufffd}\ufffd\ufffd\\\ufffd\ucd2c\ufffd3F\ufffd\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via XMPP:5222 \u00b7 (reconnaissance)",
"target_port_label": "5222 \u00b7 XMPP",
"emulator_service": "xmpp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via XMPP \u2014 multi-protocole (98 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "xmpp",
"service_label_fr": "XMPP",
"dst_port": 5222,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-xmpp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd}\ufffd\ufffd\\\ufffd\u001d\ucd2c\ufffd3\u0014F\ufffd\u001b\u001d\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5222,
"service": "xmpp",
"service_label_fr": "XMPP"
},
"attack_vector": "port scan syn \u00b7 via XMPP:5222 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd}\ufffd\ufffd\\\ufffd\ucd2c\ufffd3F\ufffd\ufffdVSJ\ufffdYj\ufffdS+\ufffd\ufffd$\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5222 \u00b7 XMPP",
"emulator_service": "xmpp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "xmpp",
"service_banner": "honeypot-xmpp",
"service_os": "linux",
"dst_port": "5222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 515,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 515,
"scan_velocity_ports_per_s": 159.24,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 98,
"multi_protocol_sample": [
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt",
"cloudflare-tunnel"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello",
"xmpp_emulated",
"xmpp_payload"
]
}
|
|
|
TCP |
548 · AFP
|
afp
|
Scan de ports
port scan syn · via AFP:548 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
AFP
WAF
—
Recommandation
Surveiller
Tags
afp_emulated
afp_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
548
Chemin / cible
—
Service
AFP
Payload
{ w)|�<���Z��m��o*%<hZp�����X)��� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w)|�<���Z��m��o*%<hZp�����X)��� �/�+���� ��
/ 5�
4
�
Requête brute (extrait)
{ w)|�<���Z��m��o*%<hZp�����X)��� �/�+���� �� / 5� 4 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01040000000000000000000041465056657273696f6e20332e330d10000612000000",
"emulator_response_len": 34,
"bytes_in": 135,
"payload_entropy": 4.8804500834971885,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "afp",
"app_proto": "afp",
"asn": 47890,
"country": "RO",
"dst_port": 548,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b3d3a49ad8db0b47586eab2304d1b07d8473bce1",
"event_fingerprint": "a11fbd6b360ad45474263befa4df27d7a93a05eb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "afp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "265a297e2883c677f2fe8ae2aa89eafa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 548,
"service": "afp",
"service_name": "afp",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<\u0010hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<\u0010hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000\u0015\u0003\u0001\u0000\u0002\u0002\n",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<\u0010hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae73d60baa8a8d22bca32f16f9887911baa7dcc3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<\u0010hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 548,
"service": "afp",
"service_label_fr": "AFP"
},
"evidence_snippet": "{w)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)",
"target_port_label": "548 \u00b7 AFP",
"emulator_service": "afp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AFP \u2014 multi-protocole (99 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "afp",
"service_label_fr": "AFP",
"dst_port": 548,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-afp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<\u0010hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 548,
"service": "afp",
"service_label_fr": "AFP"
},
"attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)",
"evidence_snippet": "{w)|\ufffd<\ufffd\ufffd\ufffdZ\ufffd\ufffdm\ufffd\ufffdo*%<hZp\ufffd\ufffd\ufffd\ufffd\ufffdX)\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "548 \u00b7 AFP",
"emulator_service": "afp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "afp",
"service_banner": "honeypot-afp",
"service_os": "linux",
"dst_port": "548"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 516,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 516,
"scan_velocity_ports_per_s": 159.27,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 99,
"multi_protocol_sample": [
"afp",
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"afp_emulated",
"afp_payload",
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
5433 · POSTGRES
|
postgres
|
Scan de ports
port scan syn · via POSTGRES:5433 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379 Handshake PostgreSQL (startup)
Émulateur
POSTGRES
WAF
—
Recommandation
Surveiller
Tags
net_flood
postgres_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5433
Chemin / cible
—
Service
POSTGRES
Payload
{ w29p��`���MҢ�$��U�ɴ�S�&������ �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
Postgres alt port scan
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w29p��`���MҢ�$��U�ɴ�S�&������ �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 128,
"payload_entropy": 4.852778769891415,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "postgres",
"app_proto": "postgres",
"asn": 47890,
"country": "RO",
"dst_port": 5433,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0ddee4a74372064506b074b03e823a7232f0a787",
"event_fingerprint": "d2d54b575d36c31e8f7f9509213e362551ba9749",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0636"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"Postgres alt port scan"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0636"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9b255228c09dbc2e8cf48b5f3307608c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5433,
"service": "postgres",
"service_name": "postgres",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u000329p\u0017\ufffd\ufffd`\u0001\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u000329p\u0017\ufffd\ufffd`\u0001\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u000329p\u0017\ufffd\ufffd`\u0001\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46c5507845cdf65c6909466f91eea34657b6bf2c",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u000329p\u0017\ufffd\ufffd`\u0001\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5433,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"evidence_snippet": "{w29p\ufffd\ufffd`\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via POSTGRES:5433 \u00b7 (reconnaissance)",
"target_port_label": "5433 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via POSTGRES \u2014 multi-protocole (100 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "postgres",
"service_label_fr": "POSTGRES",
"dst_port": 5433,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-postgres",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u000329p\u0017\ufffd\ufffd`\u0001\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 5433,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "port scan syn \u00b7 via POSTGRES:5433 \u00b7 (reconnaissance)",
"evidence_snippet": "{w29p\ufffd\ufffd`\ufffd\ufffd\ufffdM\u04a2\ufffd$\ufffd\ufffdU\ufffd\u0274\ufffdS\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "5433 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "honeypot-postgres",
"service_os": "linux",
"dst_port": "5433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 517,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
83,
85,
104,
106,
111,
119,
122
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 517,
"scan_velocity_ports_per_s": 159.28,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 100,
"multi_protocol_sample": [
"afp",
"aim",
"ajp",
"aws-ecs-agent",
"bgp",
"cassandra-jmx",
"chargen",
"cics-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"postgres_emulated",
"tls_clienthello"
]
}
|
|
|
TCP |
3780 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3780 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3780
Chemin / cible
—
Service
TLS
Payload
{ w6�ך��|�wR�˄ʼn Ϛ��CX"I�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w6�ך��|�wR�˄ʼn Ϛ��CX"I�� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.764926328502067,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3780,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a266123df76248f8a792564b00d960e347ac2efe",
"event_fingerprint": "357bac2b77cc68e6ab83ee20cc9ac7f9a2d642d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "abe73d6d4842e9925178f24ebd94be7a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3780,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036\ufffd\u05da\ufffd\ufffd\u0001|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffd\u0013CX\"I\ufffd\ufffd\u0002\f\u0013\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036\ufffd\u05da\ufffd\ufffd\u0001|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffd\u0013CX\"I\ufffd\ufffd\u0002\f\u0013\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036\ufffd\u05da\ufffd\ufffd\u0001|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffd\u0013CX\"I\ufffd\ufffd\u0002\f\u0013\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f353c0db5cee6cbfc5dc5ca70672bfc9176a31c8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036\ufffd\u05da\ufffd\ufffd\u0001|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffd\u0013CX\"I\ufffd\ufffd\u0002\f\u0013\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3780,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w6\ufffd\u05da\ufffd\ufffd|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffdCX\"I\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3780 \u00b7 (reconnaissance)",
"target_port_label": "3780 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (55 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3780,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u00036\ufffd\u05da\ufffd\ufffd\u0001|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffd\u0013CX\"I\ufffd\ufffd\u0002\f\u0013\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3780,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3780 \u00b7 (reconnaissance)",
"evidence_snippet": "{w6\ufffd\u05da\ufffd\ufffd|\ufffdwR\ufffd\u02c4\u0149\t\u03da\ufffd\ufffdCX\"I\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3780 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3780"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 318,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 318,
"scan_velocity_ports_per_s": 155.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 55,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
314 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:314 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
314
Chemin / cible
—
Service
TLS
Payload
{ wƇԘՠȢ���1��[�����[4˻ !9� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wƇԘՠȢ���1��[�����[4˻ !9� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.861264444322512,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 314,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d3c030d99f91b3d2228f1afc7c2429c85592c4f4",
"event_fingerprint": "cfe3bb27c54f5f92d820232a01ecba8182cd0f8c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0893838e25519177e5fccab446a93644",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 314,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0187\u0518\u0560\u0222\ufffd\ufffd\u0018\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\u0006\ufffd[4\u02fb\u001e!9\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0187\u0518\u0560\u0222\ufffd\ufffd\u0018\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\u0006\ufffd[4\u02fb\u001e!9\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0187\u0518\u0560\u0222\ufffd\ufffd\u0018\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\u0006\ufffd[4\u02fb\u001e!9\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d72c6aab86492b1a9367ea5d0b30420b54554b5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0187\u0518\u0560\u0222\ufffd\ufffd\u0018\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\u0006\ufffd[4\u02fb\u001e!9\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 314,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\u0187\u0518\u0560\u0222\ufffd\ufffd\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffd[4\u02fb!9\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:314 \u00b7 (reconnaissance)",
"target_port_label": "314 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (55 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 314,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0187\u0518\u0560\u0222\ufffd\ufffd\u0018\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\u0006\ufffd[4\u02fb\u001e!9\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 314,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:314 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\u0187\u0518\u0560\u0222\ufffd\ufffd\ufffd1\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffd[4\u02fb!9\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "314 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "314"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 319,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 319,
"scan_velocity_ports_per_s": 156.05,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 55,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
30120 · FIVEM GAME
|
fivem-game
|
Scan de ports
port scan syn · via FIVEM GAME:30120 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
FIVEM-GAME
WAF
—
Recommandation
Surveiller
Tags
fivem_game_emulated
fivem_game_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30120
Chemin / cible
—
Service
FIVEM GAME
Payload
{ w��5��R�L�<KQ��3�����~)� N �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��5��R�L�<KQ��3�����~)� N �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "ffffffff54536f7572636520456e67696e6520517565727900",
"emulator_response_len": 25,
"bytes_in": 128,
"payload_entropy": 4.845639444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "fivem-game",
"app_proto": "fivem-game",
"asn": 47890,
"country": "RO",
"dst_port": 30120,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d4355e36e77f23a389e3c0ead8d4d8fda22b7e74",
"event_fingerprint": "69576cb1038bdcbd03fceb3fe3c65c5f956080c7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "fivem-game",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7d3fd1583e376ab557a30231b0ce88c9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 30120,
"service": "fivem-game",
"service_name": "fivem-game",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd5\b\u0007\ufffd\ufffdR\ufffdL\ufffd<KQ\u0007\ufffd\ufffd3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd~\u0012)\ufffd N\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd5\b\u0007\ufffd\ufffdR\ufffdL\ufffd<KQ\u0007\ufffd\ufffd3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd~\u0012)\ufffd N\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd5\b\u0007\ufffd\ufffdR\ufffdL\ufffd<KQ\u0007\ufffd\ufffd3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd~\u0012)\ufffd N\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf8f43f5a80b22e90f1100c5896ff467882291af",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd5\b\u0007\ufffd\ufffdR\ufffdL\ufffd<KQ\u0007\ufffd\ufffd3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd~\u0012)\ufffd N\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30120,
"service": "fivem-game",
"service_label_fr": "FIVEM GAME"
},
"evidence_snippet": "{w\ufffd\ufffd5\ufffd\ufffdR\ufffdL\ufffd<KQ\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd~)\ufffd N\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via FIVEM GAME:30120 \u00b7 (reconnaissance)",
"target_port_label": "30120 \u00b7 FIVEM GAME",
"emulator_service": "fivem-game",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FIVEM GAME \u2014 multi-protocole (56 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "fivem-game",
"service_label_fr": "FIVEM GAME",
"dst_port": 30120,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-fivem-game",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd5\b\u0007\ufffd\ufffdR\ufffdL\ufffd<KQ\u0007\ufffd\ufffd3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd~\u0012)\ufffd N\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30120,
"service": "fivem-game",
"service_label_fr": "FIVEM GAME"
},
"attack_vector": "port scan syn \u00b7 via FIVEM GAME:30120 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd5\ufffd\ufffdR\ufffdL\ufffd<KQ\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd~)\ufffd N\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "30120 \u00b7 FIVEM GAME",
"emulator_service": "fivem-game",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "fivem_game",
"service_banner": "honeypot-fivem-game",
"service_os": "linux",
"dst_port": "30120"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 320,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 320,
"scan_velocity_ports_per_s": 156.1,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 56,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"fivem_game_emulated",
"fivem_game_payload",
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
3542 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3542 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3542
Chemin / cible
—
Service
TLS
Payload
{ w����:L�D��M� L� �k��.�sd�<��� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w����:L�D��M� L� �k��.�sd�<��� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.814389444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3542,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fd0ab829fd31bbeb7df2e6bcef4e0d47862d0425",
"event_fingerprint": "6575dd98a707b7b2a0070b64cbee8a7ea3d48a6a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "3694fde3ac67c344873523dedc654790",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3542,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd:\u0007L\ufffdD\ufffd\ufffdM\ufffd\u000bL\ufffd\u000b\u0006\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\u0004\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd:\u0007L\ufffdD\ufffd\ufffdM\ufffd\u000bL\ufffd\u000b\u0006\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\u0004\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd:\u0007L\ufffdD\ufffd\ufffdM\ufffd\u000bL\ufffd\u000b\u0006\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\u0004\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "988b262e1dde3c82eecc6bca40ae0ebac8f8a31a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd:\u0007L\ufffdD\ufffd\ufffdM\ufffd\u000bL\ufffd\u000b\u0006\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\u0004\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3542,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd:L\ufffdD\ufffd\ufffdM\ufffdL\ufffd\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3542 \u00b7 (reconnaissance)",
"target_port_label": "3542 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (56 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3542,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\ufffd:\u0007L\ufffdD\ufffd\ufffdM\ufffd\u000bL\ufffd\u000b\u0006\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\u0004\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3542,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3542 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd\ufffd:L\ufffdD\ufffd\ufffdM\ufffdL\ufffd\ufffdk\ufffd\ufffd.\ufffdsd\ufffd<\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3542 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3542"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 321,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 321,
"scan_velocity_ports_per_s": 156.15,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 56,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
400 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:400 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
400
Chemin / cible
—
Service
TLS
Payload
{ wU9��?�������Z^��� ّdɯ8s%jY �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wU9��?�������Z^��� ّdɯ8s%jY �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.898412002933164,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "eff768591a899e9078d58d1936ce6e02756de5bb",
"event_fingerprint": "390e9403b17447aa9efdc11156659f51ced076e2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "cac02ab77ea3967db230f1e50d672e48",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 400,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003U9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdZ^\ufffd\u0011\ufffd\ufffd\u001e\u0651d\u026f8\u000es%jY\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003U9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdZ^\ufffd\u0011\ufffd\ufffd\u001e\u0651d\u026f8\u000es%jY\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003U9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdZ^\ufffd\u0011\ufffd\ufffd\u001e\u0651d\u026f8\u000es%jY\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cbd592f48b6aad7d0ef55ef19b4fb6ef0ba599b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003U9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdZ^\ufffd\u0011\ufffd\ufffd\u001e\u0651d\u026f8\u000es%jY\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 400,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{wU9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZ^\ufffd\ufffd\ufffd\u0651d\u026f8s%jY\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:400 \u00b7 (reconnaissance)",
"target_port_label": "400 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (56 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 400,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003U9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdZ^\ufffd\u0011\ufffd\ufffd\u001e\u0651d\u026f8\u000es%jY\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 400,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:400 \u00b7 (reconnaissance)",
"evidence_snippet": "{wU9\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZ^\ufffd\ufffd\ufffd\u0651d\u026f8s%jY\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "400 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 322,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 322,
"scan_velocity_ports_per_s": 156.24,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 56,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5060 · SIP
|
sip
|
Scan de ports
port scan syn · via SIP:5060 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SIP
WAF
—
Recommandation
Surveiller
Tags
net_flood
sip_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5060
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d",
"emulator_response_len": 215,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "sip",
"app_proto": "sip",
"asn": 47890,
"country": "RO",
"dst_port": 5060,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "edf1059041c4e2a6422d014d4c1ae08870c3a079",
"event_fingerprint": "21fcb9edfdc69f137c4a6c579dcdd5bab4af1392",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "sip",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5060,
"service": "sip",
"service_name": "sip",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75d5d65a76c1b10fa62dc44404109ae928bdd2e5",
"protocol_details": {
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"attack_vector": "port scan syn \u00b7 via SIP:5060 \u00b7 (reconnaissance)",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP \u2014 multi-protocole (149 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "sip",
"service_label_fr": "SIP",
"dst_port": 5060,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"attack_vector": "port scan syn \u00b7 via SIP:5060 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip",
"service_banner": "honeypot-sip",
"service_os": "linux",
"dst_port": "5060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 832,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
49,
70,
79,
81,
82,
83,
84,
85
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 744,
"scan_velocity_ports_per_s": 150.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"iot",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 149,
"multi_protocol_sample": [
"accessbuilder",
"afp",
"aim",
"ajp",
"arangodb",
"aws-ecs-agent",
"bgp",
"bittorrent"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"sip_emulated"
]
}
|
|
|
TCP |
32101 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:32101 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32101
Chemin / cible
—
Service
TLS
Payload
{ wP? {b� Ko�/ ��8�*���Om�G�wA �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wP?
{b� Ko�/ ��8�*���Om�G�wA �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.752669643307746,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 32101,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0bbc82176224b60dcae9c4745152d97ab65dc230",
"event_fingerprint": "ecc4de26074ee32b1c5d3db57d1d440da71b5181",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "f2cafc6365e22c5f06f65c28ac94df37",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 32101,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003P?\r{b\ufffd\u001f\u000eKo\ufffd\/\u0003\u000b\u0004\u000e\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffd\u001bwA\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003P?\r{b\ufffd\u001f\u000eKo\ufffd\/\u0003\u000b\u0004\u000e\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffd\u001bwA\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003P?\r{b\ufffd\u001f\u000eKo\ufffd\/\u0003\u000b\u0004\u000e\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffd\u001bwA\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5995bf9bbd964907679b8be6d0a899693da8aac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003P?\r{b\ufffd\u001f\u000eKo\ufffd\/\u0003\u000b\u0004\u000e\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffd\u001bwA\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 32101,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{wP?\r{b\ufffdKo\ufffd\/\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffdwA\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:32101 \u00b7 (reconnaissance)",
"target_port_label": "32101 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (56 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 32101,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003P?\r{b\ufffd\u001f\u000eKo\ufffd\/\u0003\u000b\u0004\u000e\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffd\u001bwA\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 32101,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:32101 \u00b7 (reconnaissance)",
"evidence_snippet": "{wP?\r{b\ufffdKo\ufffd\/\ufffd\ufffd8\ufffd*\ufffd\ufffd\ufffdOm\ufffdG\ufffdwA\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "32101 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "32101"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 323,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 323,
"scan_velocity_ports_per_s": 156.32,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 56,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
2404 · IEC104
|
iec104
|
Scan de ports
port scan syn · via IEC104:2404 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
IEC104
WAF
—
Recommandation
Surveiller
Tags
iec104_emulated
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2404
Chemin / cible
—
Service
IEC104
Payload
{ w�X ]�6G� w�Xrh�#wQ"�΅&�&�}���� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�X ]�6G� w�Xrh�#wQ"�΅&�&�}���� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 128,
"payload_entropy": 4.815169643307746,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "iec104",
"app_proto": "iec104",
"asn": 47890,
"country": "RO",
"dst_port": 2404,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fd445c7c5b3001cbc5934f6e66841ca610a937aa",
"event_fingerprint": "56e0e3b058a12bb4a7089a2ba5b389b5db08efa4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "iec104",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ab3c49591aabb9dfc6505ceefc0fa509",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2404,
"service": "iec104",
"service_name": "iec104",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\f]\ufffd6G\ufffd\fw\ufffdXrh\ufffd#wQ\u0003\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\f]\ufffd6G\ufffd\fw\ufffdXrh\ufffd#wQ\u0003\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\f]\ufffd6G\ufffd\fw\ufffdXrh\ufffd#wQ\u0003\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61d908ee40f660dad7df4df1ffb7bb0c23f5c9a7",
"protocol_details": {
"iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)",
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\f]\ufffd6G\ufffd\fw\ufffdXrh\ufffd#wQ\u0003\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 2404,
"service": "iec104",
"service_label_fr": "IEC104"
},
"evidence_snippet": "{w\ufffdX]\ufffd6G\ufffdw\ufffdXrh\ufffd#wQ\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via IEC104:2404 \u00b7 (reconnaissance)",
"target_port_label": "2404 \u00b7 IEC104",
"emulator_service": "iec104",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IEC104 \u2014 multi-protocole (57 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "iec104",
"service_label_fr": "IEC104",
"dst_port": 2404,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iec104",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)",
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdX\f]\ufffd6G\ufffd\fw\ufffdXrh\ufffd#wQ\u0003\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 2404,
"service": "iec104",
"service_label_fr": "IEC104"
},
"attack_vector": "port scan syn \u00b7 via IEC104:2404 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffdX]\ufffd6G\ufffdw\ufffdXrh\ufffd#wQ\"\ufffd\u0385&\ufffd&\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "2404 \u00b7 IEC104",
"emulator_service": "iec104",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iec104",
"service_banner": "honeypot-iec104",
"service_os": "linux",
"dst_port": "2404"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 324,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 324,
"scan_velocity_ports_per_s": 156.39,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 57,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"iec104_emulated",
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
3050 · FIREBIRD
|
firebird
|
Scan de ports
port scan syn · via FIREBIRD:3050 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
FIREBIRD
WAF
—
Recommandation
Surveiller
Tags
firebird_emulated
firebird_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3050
Chemin / cible
—
Service
FIREBIRD
Payload
{ w�>+HEr �V�H<����:H�V 肌��l� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�>+HEr
�V�H<����:H�V 肌��l� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "000000090000000003",
"emulator_response_len": 9,
"bytes_in": 128,
"payload_entropy": 4.756226604962698,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "firebird",
"app_proto": "firebird",
"asn": 47890,
"country": "RO",
"dst_port": 3050,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "57dc753929be950213d066da455d42e4ea7a4549",
"event_fingerprint": "85d5be0ccd9469c93460f0d94ca5de5fda0f0f57",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "firebird",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7871e6a774bf4405ef63fa22811d70a6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3050,
"service": "firebird",
"service_name": "firebird",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0007>+HEr\r\ufffd\u000eV\ufffdH<\u0014\ufffd\ufffd\ufffd\u0006\ufffd:H\ufffdV\u001d\u808c\ufffd\ufffdl\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0007>+HEr\r\ufffd\u000eV\ufffdH<\u0014\ufffd\ufffd\ufffd\u0006\ufffd:H\ufffdV\u001d\u808c\ufffd\ufffdl\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0007>+HEr\r\ufffd\u000eV\ufffdH<\u0014\ufffd\ufffd\ufffd\u0006\ufffd:H\ufffdV\u001d\u808c\ufffd\ufffdl\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c24528edee6473ea74ef3f3d494bc6f0f1441d5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0007>+HEr\r\ufffd\u000eV\ufffdH<\u0014\ufffd\ufffd\ufffd\u0006\ufffd:H\ufffdV\u001d\u808c\ufffd\ufffdl\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3050,
"service": "firebird",
"service_label_fr": "FIREBIRD"
},
"evidence_snippet": "{w\ufffd>+HEr\r\ufffdV\ufffdH<\ufffd\ufffd\ufffd\ufffd:H\ufffdV\u808c\ufffd\ufffdl\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via FIREBIRD:3050 \u00b7 (reconnaissance)",
"target_port_label": "3050 \u00b7 FIREBIRD",
"emulator_service": "firebird",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FIREBIRD \u2014 multi-protocole (58 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "firebird",
"service_label_fr": "FIREBIRD",
"dst_port": 3050,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-firebird",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0007>+HEr\r\ufffd\u000eV\ufffdH<\u0014\ufffd\ufffd\ufffd\u0006\ufffd:H\ufffdV\u001d\u808c\ufffd\ufffdl\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3050,
"service": "firebird",
"service_label_fr": "FIREBIRD"
},
"attack_vector": "port scan syn \u00b7 via FIREBIRD:3050 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd>+HEr\r\ufffdV\ufffdH<\ufffd\ufffd\ufffd\ufffd:H\ufffdV\u808c\ufffd\ufffdl\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3050 \u00b7 FIREBIRD",
"emulator_service": "firebird",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "firebird",
"service_banner": "honeypot-firebird",
"service_os": "linux",
"dst_port": "3050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 325,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 325,
"scan_velocity_ports_per_s": 156.47,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 58,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"firebird_emulated",
"firebird_payload",
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
30110 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:30110 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30110
Chemin / cible
—
Service
TLS
Payload
{ w��{x���3�G�QD�"�H +�b�PM���$ҙ� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��{x���3�G�QD�"�H
+�b�PM���$ҙ� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.84258976052905,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 30110,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "25756f4391bdd51d90f2f743d08067c3ab0522ea",
"event_fingerprint": "2ff46254ca8cb4f5cca9a834e03b70ecd040937a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "badc2c1803b411e9c44b2f426634820e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 30110,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\u0003\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\u0003\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\u0003\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77663b8f880beebd662f873b6d111789ca527144",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\u0003\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30110,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:30110 \u00b7 (reconnaissance)",
"target_port_label": "30110 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (58 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 30110,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\u0003\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30110,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:30110 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd{x\ufffd\ufffd\ufffd3\ufffdG\ufffdQD\ufffd\"\ufffdH\n+\ufffdb\ufffdPM\ufffd\ufffd\ufffd$\u0499\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "30110 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "30110"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 326,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 326,
"scan_velocity_ports_per_s": 156.52,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 58,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3165 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3165 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3165
Chemin / cible
—
Service
TLS
Payload
{ wS ���XZ �:)��ˈ!G�M&P��u3 �� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wS ���XZ �:)��ˈ!G�M&P��u3 �� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.832631421854986,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3165,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a1ebc3f030b02e86fd0790861ed5bb2f3d2022e4",
"event_fingerprint": "9a30c4f24933728ade04da9881a41e26328cd231",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "9f506f80d4e101985927481c4fc401b4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3165,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001d\u001a\ufffd\ufffd\ufffdXZ\u0013\b\u0000\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001d\u001a\ufffd\ufffd\ufffdXZ\u0013\b\u0000\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001d\u001a\ufffd\ufffd\ufffdXZ\u0013\b\u0000\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6885b176341878c025511cbf1901be53d65b241d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001d\u001a\ufffd\ufffd\ufffdXZ\u0013\b\u0000\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3165,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{wS\ufffd\ufffd\ufffdXZ\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3165 \u00b7 (reconnaissance)",
"target_port_label": "3165 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (58 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3165,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003S\u001d\u001a\ufffd\ufffd\ufffdXZ\u0013\b\u0000\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3165,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3165 \u00b7 (reconnaissance)",
"evidence_snippet": "{wS\ufffd\ufffd\ufffdXZ\ufffd:)\ufffd\ufffd\u02c8!G\ufffdM&P\ufffd\ufffdu3\t\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3165 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3165"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 327,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 327,
"scan_velocity_ports_per_s": 156.58,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 58,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
30000 · MINIKUBE NODEPORT
|
minikube-nodeport
|
Scan de ports
port scan syn · via MINIKUBE NODEPORT:30000 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
MINIKUBE-NODEPORT
WAF
—
Recommandation
Surveiller
Tags
minikube_nodeport_emulated
minikube_nodeport_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30000
Chemin / cible
—
Service
MINIKUBE NODEPORT
Payload
{ wK�Sw�ꨯ$� �<CR�<ٜ��u��?Ӂ`<� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wK�Sw�ꨯ$� �<CR�<ٜ��u��?Ӂ`<� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 128,
"payload_entropy": 4.892514444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "minikube-nodeport",
"app_proto": "minikube-nodeport",
"asn": 47890,
"country": "RO",
"dst_port": 30000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0fb212996944bb497241cf4ef3010ad716349357",
"event_fingerprint": "9d154c4fb13d66580fe723e07779170702df6245",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "minikube-nodeport",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81f70c541d6134562e35b29b105f8c2f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 30000,
"service": "minikube-nodeport",
"service_name": "minikube-nodeport",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003K\ufffdSw\ufffd\uaa2f$\ufffd\f\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\u001b\ufffd\ufffd?\u04c1`<\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003K\ufffdSw\ufffd\uaa2f$\ufffd\f\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\u001b\ufffd\ufffd?\u04c1`<\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003K\ufffdSw\ufffd\uaa2f$\ufffd\f\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\u001b\ufffd\ufffd?\u04c1`<\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b42f4dbdb8e6c2d924047cbf886171cc12e1cfd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003K\ufffdSw\ufffd\uaa2f$\ufffd\f\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\u001b\ufffd\ufffd?\u04c1`<\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30000,
"service": "minikube-nodeport",
"service_label_fr": "MINIKUBE NODEPORT"
},
"evidence_snippet": "{wK\ufffdSw\ufffd\uaa2f$\ufffd\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\ufffd\ufffd?\u04c1`<\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via MINIKUBE NODEPORT:30000 \u00b7 (reconnaissance)",
"target_port_label": "30000 \u00b7 MINIKUBE NODEPORT",
"emulator_service": "minikube-nodeport",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MINIKUBE NODEPORT \u2014 multi-protocole (59 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "minikube-nodeport",
"service_label_fr": "MINIKUBE NODEPORT",
"dst_port": 30000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minikube-nodeport",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003K\ufffdSw\ufffd\uaa2f$\ufffd\f\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\u001b\ufffd\ufffd?\u04c1`<\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 30000,
"service": "minikube-nodeport",
"service_label_fr": "MINIKUBE NODEPORT"
},
"attack_vector": "port scan syn \u00b7 via MINIKUBE NODEPORT:30000 \u00b7 (reconnaissance)",
"evidence_snippet": "{wK\ufffdSw\ufffd\uaa2f$\ufffd\ufffd<CR\ufffd<\u065c\ufffd\ufffdu\ufffd\ufffd?\u04c1`<\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "30000 \u00b7 MINIKUBE NODEPORT",
"emulator_service": "minikube-nodeport",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minikube_nodeport",
"service_banner": "honeypot-minikube-nodeport",
"service_os": "linux",
"dst_port": "30000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 328,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 328,
"scan_velocity_ports_per_s": 156.62,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 59,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"minikube_nodeport_emulated",
"minikube_nodeport_payload",
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
2181 · ZOOKEEPER
|
zookeeper
|
Scan de ports
port scan syn · via ZOOKEEPER:2181 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
ZOOKEEPER
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2181
Chemin / cible
—
Service
ZOOKEEPER
Payload
{ w�~uS�(�ʮ�ߛ�N(�T���V���r��@b �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�~uS�(�ʮ�ߛ�N(�T���V���r��@b �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a",
"emulator_response_len": 60,
"bytes_in": 128,
"payload_entropy": 4.854586686726627,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "zookeeper",
"app_proto": "zookeeper",
"asn": 47890,
"country": "RO",
"dst_port": 2181,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "01bb40c31b6350ff1ae250c81067e8b888726b1b",
"event_fingerprint": "86fcb0011f72b70838244e2a6ec84ec3388841a8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "zookeeper",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "734d9380c718ec035c3fd8ffb9ea8942",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2181,
"service": "zookeeper",
"service_name": "zookeeper",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\u0013\ufffdV\ufffd\u0005\ufffd\ufffdr\ufffd\ufffd@\u0017b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\u0013\ufffdV\ufffd\u0005\ufffd\ufffdr\ufffd\ufffd@\u0017b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\u0013\ufffdV\ufffd\u0005\ufffd\ufffdr\ufffd\ufffd@\u0017b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5817c666e22ef7d028f4889d92abc2eb40ca7a9f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\u0013\ufffdV\ufffd\u0005\ufffd\ufffdr\ufffd\ufffd@\u0017b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"evidence_snippet": "{w\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdr\ufffd\ufffd@b\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via ZOOKEEPER:2181 \u00b7 (reconnaissance)",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ZOOKEEPER \u2014 multi-protocole (60 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "zookeeper",
"service_label_fr": "ZOOKEEPER",
"dst_port": 2181,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-zookeeper",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\u0013\ufffdV\ufffd\u0005\ufffd\ufffdr\ufffd\ufffd@\u0017b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"attack_vector": "port scan syn \u00b7 via ZOOKEEPER:2181 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd~uS\ufffd(\ufffd\u02ae\ufffd\u07db\ufffdN(\ufffdT\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdr\ufffd\ufffd@b\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "zookeeper",
"service_banner": "honeypot-zookeeper",
"service_os": "linux",
"dst_port": "2181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 329,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 329,
"scan_velocity_ports_per_s": 156.69,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 60,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
32400 · PLEX
|
plex
|
Scan de ports
port scan syn · via PLEX:32400 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
{ w�(FVSE�b�vP�Q��)�j���%N��k�4� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�(FVSE�b�vP�Q��)�j���%N��k�4� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a",
"emulator_response_len": 36,
"bytes_in": 128,
"payload_entropy": 4.898412002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "plex",
"app_proto": "plex",
"asn": 47890,
"country": "RO",
"dst_port": 32400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "8c333158e0fcd0bab4098110433e0a54cd00bbe7",
"event_fingerprint": "e7a7502d5e15aea87d560a9e4262439a5b0f01f3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "plex",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4320dfdb0cfd520ab649ad618dc3ffe6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 32400,
"service": "plex",
"service_name": "plex",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd(FV\u001bSE\ufffdb\ufffd\u0013vP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\u0010\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd(FV\u001bSE\ufffdb\ufffd\u0013vP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\u0010\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd(FV\u001bSE\ufffdb\ufffd\u0013vP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\u0010\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8313aae3cf175434458f4802c869c2bfb48a5e77",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd(FV\u001bSE\ufffdb\ufffd\u0013vP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\u0010\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 32400,
"service": "plex",
"service_label_fr": "PLEX"
},
"evidence_snippet": "{w\ufffd(FVSE\ufffdb\ufffdvP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via PLEX:32400 \u00b7 (reconnaissance)",
"target_port_label": "32400 \u00b7 PLEX",
"emulator_service": "plex",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PLEX \u2014 multi-protocole (61 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "plex",
"service_label_fr": "PLEX",
"dst_port": 32400,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-plex",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd(FV\u001bSE\ufffdb\ufffd\u0013vP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\u0010\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 32400,
"service": "plex",
"service_label_fr": "PLEX"
},
"attack_vector": "port scan syn \u00b7 via PLEX:32400 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd(FVSE\ufffdb\ufffdvP\ufffdQ\ufffd\ufffd)\ufffdj\ufffd\ufffd\ufffd%N\ufffd\ufffdk\ufffd4\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "32400 \u00b7 PLEX",
"emulator_service": "plex",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "plex",
"service_banner": "honeypot-plex",
"service_os": "linux",
"dst_port": "32400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 330,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 330,
"scan_velocity_ports_per_s": 156.75,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 61,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
25007 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:25007 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25007
Chemin / cible
—
Service
TLS
Payload
{ w ��\�;��Sp?f�r¸2CqV�'�� I��? �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w ��\�;��Sp?f�r¸2CqV�'�� I��? �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.873059561543816,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 25007,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5781446999f8f6e93148d7b92aa0562e6c8fb4be",
"event_fingerprint": "8f579e580f609f8e300703e09a990ab86744e01f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0ab59b7697fa2965e96e8ec403c547a6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 25007,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\f\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffd\u0002r\u00b82Cq\u0013V\ufffd'\ufffd\ufffd\u001dI\ufffd\u0019\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\f\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffd\u0002r\u00b82Cq\u0013V\ufffd'\ufffd\ufffd\u001dI\ufffd\u0019\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\f\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffd\u0002r\u00b82Cq\u0013V\ufffd'\ufffd\ufffd\u001dI\ufffd\u0019\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9976f3a1660cf7bac2c24bcbc5a85b7975451a70",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\f\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffd\u0002r\u00b82Cq\u0013V\ufffd'\ufffd\ufffd\u001dI\ufffd\u0019\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 25007,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffdr\u00b82CqV\ufffd'\ufffd\ufffdI\ufffd\ufffd?\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:25007 \u00b7 (reconnaissance)",
"target_port_label": "25007 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (61 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 25007,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\f\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffd\u0002r\u00b82Cq\u0013V\ufffd'\ufffd\ufffd\u001dI\ufffd\u0019\ufffd?\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 25007,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:25007 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\\\ufffd;\ufffd\ufffdSp?f\ufffdr\u00b82CqV\ufffd'\ufffd\ufffdI\ufffd\ufffd?\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "25007 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "25007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 331,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 331,
"scan_velocity_ports_per_s": 156.82,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 61,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Scan de ports
port scan syn · via REMOTEANYTHING:4000 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
{ w�� ߗ���T�� �`;I�6e���m Ij�! �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�� ߗ���T�� �`;I�6e���m Ij�! �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 128,
"payload_entropy": 4.867162002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 47890,
"country": "RO",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b41747e32ef28f6b1af764b5816f70196d9da395",
"event_fingerprint": "6e546825913af94cb1b669852b6bdd8a5b18530c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c3a703f7c83759e570d7536e7cd8dee9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\ufffd\ufffd\u000b\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\u001c\ufffd`;I\ufffd\u00106e\ufffd\ufffd\ufffdm\fIj\ufffd!\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\ufffd\ufffd\u000b\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\u001c\ufffd`;I\ufffd\u00106e\ufffd\ufffd\ufffdm\fIj\ufffd!\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\ufffd\ufffd\u000b\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\u001c\ufffd`;I\ufffd\u00106e\ufffd\ufffd\ufffdm\fIj\ufffd!\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a8bd1648f43afb9da71e16c4b24ba55f4c8e5a4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\ufffd\ufffd\u000b\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\u001c\ufffd`;I\ufffd\u00106e\ufffd\ufffd\ufffdm\fIj\ufffd!\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "{w\ufffd\ufffd\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd`;I\ufffd6e\ufffd\ufffd\ufffdmIj\ufffd!\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REMOTEANYTHING \u2014 multi-protocole (62 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\ufffd\ufffd\u000b\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\u001c\ufffd`;I\ufffd\u00106e\ufffd\ufffd\ufffdm\fIj\ufffd!\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\u07d7\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd`;I\ufffd6e\ufffd\ufffd\ufffdmIj\ufffd!\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 332,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 332,
"scan_velocity_ports_per_s": 156.89,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 62,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
3590 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3590 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3590
Chemin / cible
—
Service
TLS
Payload
{ w�oW̏ �J�6�Mko ��Z��Z�fJ�?:�c �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�oW̏ �J�6�Mko ��Z��Z�fJ�?:�c �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.805442201918398,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3590,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2c56206113cf0b74a73f3b98930c4aa4fb2fccca",
"event_fingerprint": "bcd8469629a6a582a426a1e11950504beabf60c4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "e22ba5b9a8b7db5da141fdcc72c5192a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3590,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdoW\u030f\f\ufffdJ\ufffd6\ufffdM\u0003ko\u000b\ufffd\ufffd\u0014Z\ufffd\ufffd\u0011Z\ufffdfJ\ufffd?:\ufffdc\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdoW\u030f\f\ufffdJ\ufffd6\ufffdM\u0003ko\u000b\ufffd\ufffd\u0014Z\ufffd\ufffd\u0011Z\ufffdfJ\ufffd?:\ufffdc\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdoW\u030f\f\ufffdJ\ufffd6\ufffdM\u0003ko\u000b\ufffd\ufffd\u0014Z\ufffd\ufffd\u0011Z\ufffdfJ\ufffd?:\ufffdc\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec594cf71880e187bdd0585afccc601663277693",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdoW\u030f\f\ufffdJ\ufffd6\ufffdM\u0003ko\u000b\ufffd\ufffd\u0014Z\ufffd\ufffd\u0011Z\ufffdfJ\ufffd?:\ufffdc\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3590,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffdoW\u030f\ufffdJ\ufffd6\ufffdMko\ufffd\ufffdZ\ufffd\ufffdZ\ufffdfJ\ufffd?:\ufffdc\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3590 \u00b7 (reconnaissance)",
"target_port_label": "3590 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (62 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3590,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdoW\u030f\f\ufffdJ\ufffd6\ufffdM\u0003ko\u000b\ufffd\ufffd\u0014Z\ufffd\ufffd\u0011Z\ufffdfJ\ufffd?:\ufffdc\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3590,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3590 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffdoW\u030f\ufffdJ\ufffd6\ufffdMko\ufffd\ufffdZ\ufffd\ufffdZ\ufffdfJ\ufffd?:\ufffdc\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3590 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3590"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 333,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 333,
"scan_velocity_ports_per_s": 156.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 62,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4063 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4063 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4063
Chemin / cible
—
Service
TLS
Payload
{ w� �Ű��R�6AL*�Dށ�> c2�*�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w� �Ű��R�6AL*�Dށ�> c2�*�� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.8202870029331635,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4063,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6a8c7e61b08657335b203f8f2a4a011fd960aca9",
"event_fingerprint": "d50884991f5aa1aa0bd781b305693e26676e8c5f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "1ce867d9b73dad7e2bfb13e1a4acb3fb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4063,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd \ufffd\u0170\ufffd\ufffd\u0006R\ufffd6A\u0015L*\ufffdD\u0781\ufffd> c2\ufffd*\u0004\u0010\ufffd\ufffd\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd \ufffd\u0170\ufffd\ufffd\u0006R\ufffd6A\u0015L*\ufffdD\u0781\ufffd> c2\ufffd*\u0004\u0010\ufffd\ufffd\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd \ufffd\u0170\ufffd\ufffd\u0006R\ufffd6A\u0015L*\ufffdD\u0781\ufffd> c2\ufffd*\u0004\u0010\ufffd\ufffd\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51d181515a8214b02933a5c0ea8acb49a7592010",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd \ufffd\u0170\ufffd\ufffd\u0006R\ufffd6A\u0015L*\ufffdD\u0781\ufffd> c2\ufffd*\u0004\u0010\ufffd\ufffd\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4063,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd \ufffd\u0170\ufffd\ufffdR\ufffd6AL*\ufffdD\u0781\ufffd> c2\ufffd*\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4063 \u00b7 (reconnaissance)",
"target_port_label": "4063 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (62 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4063,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd \ufffd\u0170\ufffd\ufffd\u0006R\ufffd6A\u0015L*\ufffdD\u0781\ufffd> c2\ufffd*\u0004\u0010\ufffd\ufffd\u0016\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4063,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4063 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd \ufffd\u0170\ufffd\ufffdR\ufffd6AL*\ufffdD\u0781\ufffd> c2\ufffd*\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4063 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4063"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 334,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 334,
"scan_velocity_ports_per_s": 157,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 62,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3541 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3541 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3541
Chemin / cible
—
Service
TLS
Payload
{ w�p^ C� �dC��T��Nd��,=O��2$����� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�p^ C� �dC��T��Nd��,=O��2$����� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.882787002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3541,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0623fbfaea3b5c4de28074514b80cda370da79c6",
"event_fingerprint": "7f6a17c22d3bca8534c6634eed4935692a7c2f33",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "185f26bbba7cf97a6b5a4a097a64be18",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3541,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdp^\u001fC\ufffd\u001c\ufffddC\ufffd\ufffdT\ufffd\u001b\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdp^\u001fC\ufffd\u001c\ufffddC\ufffd\ufffdT\ufffd\u001b\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdp^\u001fC\ufffd\u001c\ufffddC\ufffd\ufffdT\ufffd\u001b\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d3c52656566588b915903f8da4cd970cf7619597",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdp^\u001fC\ufffd\u001c\ufffddC\ufffd\ufffdT\ufffd\u001b\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3541,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffdp^C\ufffd\ufffddC\ufffd\ufffdT\ufffd\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3541 \u00b7 (reconnaissance)",
"target_port_label": "3541 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (62 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3541,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdp^\u001fC\ufffd\u001c\ufffddC\ufffd\ufffdT\ufffd\u001b\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3541,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3541 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffdp^C\ufffd\ufffddC\ufffd\ufffdT\ufffd\ufffdNd\ufffd\ufffd,=O\ufffd\ufffd2$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3541 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3541"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 335,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
104,
106,
111,
119,
122,
137,
139,
175,
179,
189
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 335,
"scan_velocity_ports_per_s": 157.07,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 62,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
37 · TIME
|
time
|
Scan de ports
port scan syn · via TIME:37 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TIME
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
37
Chemin / cible
—
Service
TIME
Payload
{ wd�������W�á/0+�� ���� �� �VF4� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wd�������W�á/0+�� ����
�� �VF4� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6a666fc6",
"emulator_response_len": 4,
"bytes_in": 128,
"payload_entropy": 4.803101604962698,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "time",
"app_proto": "time",
"asn": 47890,
"country": "RO",
"dst_port": 37,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4620da2858c8c38c425865a06f49a4dc8d624006",
"event_fingerprint": "65b2fd8186e59659b5d30b3f800c1c1e3c30db68",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "time",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b708171d9943944a1653186a160a3f22",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 37,
"service": "time",
"service_name": "time",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\f\ufffdVF\u00064\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\f\ufffdVF\u00064\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\f\ufffdVF\u00064\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e15abe14f62101108bb2c5f42b9184e120b48bb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\f\ufffdVF\u00064\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 37,
"service": "time",
"service_label_fr": "TIME"
},
"evidence_snippet": "{wd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdVF4\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TIME:37 \u00b7 (reconnaissance)",
"target_port_label": "37 \u00b7 TIME",
"emulator_service": "time",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TIME \u2014 multi-protocole (63 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "time",
"service_label_fr": "TIME",
"dst_port": 37,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-time",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\f\ufffdVF\u00064\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 37,
"service": "time",
"service_label_fr": "TIME"
},
"attack_vector": "port scan syn \u00b7 via TIME:37 \u00b7 (reconnaissance)",
"evidence_snippet": "{wd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\u00e1\/0+\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdVF4\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "37 \u00b7 TIME",
"emulator_service": "time",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "time",
"service_banner": "honeypot-time",
"service_os": "linux",
"dst_port": "37"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 336,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 336,
"scan_velocity_ports_per_s": 157.12,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 63,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
4165 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4165 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4165
Chemin / cible
—
Service
TLS
Payload
{ w���$�o�a�c���+��}f5D��Ur��r�C� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w���$�o�a�c���+��}f5D��Ur��r�C� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.867162002933164,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4165,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bd3f068acf8e163a0ccd8360dd9f51c410f02c7a",
"event_fingerprint": "36d336be89e0c4bf61ad2c97f5b626afb52e5d2a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0af4773a5edd26505b609b756aac82c3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4165,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\u000f\ufffd\u001b\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\u000f\ufffd\u001b\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\u000f\ufffd\u001b\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b78c979c1efed7feb9b378ac0a33454db7f711e9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\u000f\ufffd\u001b\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4165,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\ufffd\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4165 \u00b7 (reconnaissance)",
"target_port_label": "4165 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (63 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4165,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\u000f\ufffd\u001b\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4165,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4165 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd$\ufffdo\ufffda\ufffdc\ufffd\ufffd\ufffd+\ufffd\ufffd}f5D\ufffd\ufffdUr\ufffd\ufffdr\ufffdC\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4165 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4165"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 337,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 337,
"scan_velocity_ports_per_s": 157.19,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 63,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3531 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3531 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3531
Chemin / cible
—
Service
TLS
Payload
{ wk4�Q��*�EJp6� ��^- ��le �x�;E�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wk4�Q��*�EJp6� ��^- ��le
�x�;E�� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.857434561543816,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3531,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a218fe1b1d30dbe9e64869e8a22858baa2970287",
"event_fingerprint": "3c86e21d3e919609cc70d8d54029ce122ba554fa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "3cc39837fb56483c37f4632fe1f0d39c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3531,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003k4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\u001d\ufffd\ufffd^-\u000b\ufffd\ufffdle\n\ufffd\u0013x\ufffd;E\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003k4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\u001d\ufffd\ufffd^-\u000b\ufffd\ufffdle\n\ufffd\u0013x\ufffd;E\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003k4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\u001d\ufffd\ufffd^-\u000b\ufffd\ufffdle\n\ufffd\u0013x\ufffd;E\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8290609f90ef1278b4288254701df836b6b74920",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003k4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\u001d\ufffd\ufffd^-\u000b\ufffd\ufffdle\n\ufffd\u0013x\ufffd;E\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3531,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{wk4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\ufffd\ufffd^-\ufffd\ufffdle\n\ufffdx\ufffd;E\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3531 \u00b7 (reconnaissance)",
"target_port_label": "3531 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (63 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3531,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003k4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\u001d\ufffd\ufffd^-\u000b\ufffd\ufffdle\n\ufffd\u0013x\ufffd;E\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3531,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3531 \u00b7 (reconnaissance)",
"evidence_snippet": "{wk4\ufffdQ\ufffd\ufffd*\ufffdEJp6\ufffd\ufffd\ufffd^-\ufffd\ufffdle\n\ufffdx\ufffd;E\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3531 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3531"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 338,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 338,
"scan_velocity_ports_per_s": 157.26,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 63,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4190 · SIEVE
|
sieve
|
Scan de ports
port scan syn · via SIEVE:4190 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
SIEVE
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4190
Chemin / cible
—
Service
SIEVE
Payload
{ wr�R�����K>Dʫ�6 ���c��Čq@w �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wr�R�����K>Dʫ�6 ���c��Čq@w �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420736965766520726561647920706f72743d343139300d0a",
"emulator_response_len": 36,
"bytes_in": 128,
"payload_entropy": 4.814389444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "sieve",
"app_proto": "sieve",
"asn": 47890,
"country": "RO",
"dst_port": 4190,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5a27231504f9e0fdb30710702312ed174424fe32",
"event_fingerprint": "af041c6c8e21bb90ad8c0c3d5d531bc81e306c11",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "sieve",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cc7f54a0a29410b2f71a074bacbb18c0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4190,
"service": "sieve",
"service_name": "sieve",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0014r\ufffdR\ufffd\u0013\ufffd\ufffd\ufffd\ufffdK>D\b\u02ab\ufffd6\u000b\ufffd\ufffd\ufffdc\b\ufffd\ufffd\u010cq@w\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0014r\ufffdR\ufffd\u0013\ufffd\ufffd\ufffd\ufffdK>D\b\u02ab\ufffd6\u000b\ufffd\ufffd\ufffdc\b\ufffd\ufffd\u010cq@w\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0014r\ufffdR\ufffd\u0013\ufffd\ufffd\ufffd\ufffdK>D\b\u02ab\ufffd6\u000b\ufffd\ufffd\ufffdc\b\ufffd\ufffd\u010cq@w\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9239cf972c3c1fc8dbe3d5859d5a8439b0fc6c2f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0014r\ufffdR\ufffd\u0013\ufffd\ufffd\ufffd\ufffdK>D\b\u02ab\ufffd6\u000b\ufffd\ufffd\ufffdc\b\ufffd\ufffd\u010cq@w\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4190,
"service": "sieve",
"service_label_fr": "SIEVE"
},
"evidence_snippet": "{wr\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdK>D\u02ab\ufffd6\ufffd\ufffd\ufffdc\ufffd\ufffd\u010cq@w\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via SIEVE:4190 \u00b7 (reconnaissance)",
"target_port_label": "4190 \u00b7 SIEVE",
"emulator_service": "sieve",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIEVE \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "sieve",
"service_label_fr": "SIEVE",
"dst_port": 4190,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sieve",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0014r\ufffdR\ufffd\u0013\ufffd\ufffd\ufffd\ufffdK>D\b\u02ab\ufffd6\u000b\ufffd\ufffd\ufffdc\b\ufffd\ufffd\u010cq@w\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4190,
"service": "sieve",
"service_label_fr": "SIEVE"
},
"attack_vector": "port scan syn \u00b7 via SIEVE:4190 \u00b7 (reconnaissance)",
"evidence_snippet": "{wr\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdK>D\u02ab\ufffd6\ufffd\ufffd\ufffdc\ufffd\ufffd\u010cq@w\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4190 \u00b7 SIEVE",
"emulator_service": "sieve",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sieve",
"service_banner": "honeypot-sieve",
"service_os": "linux",
"dst_port": "4190"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 339,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 339,
"scan_velocity_ports_per_s": 157.32,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
4157 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4157 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4157
Chemin / cible
—
Service
TLS
Payload
{ w��Lڼ���s�y� �wG���v�i�t*^�O �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��Lڼ���s�y� �wG���v�i�t*^�O �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.8515370029331635,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4157,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a11f2c59a467796af88a61069048eceffd0ab4c",
"event_fingerprint": "fd9448aa0877d302e33e3702f07f4feb58baa8a1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "a9f86d018f554693344ea56311046240",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4157,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0006\ufffd\ufffdL\u06bc\ufffd\u0006\ufffd\ufffds\ufffdy\ufffd\u001d\ufffdwG\ufffd\ufffd\b\ufffdv\ufffdi\ufffdt*\u0016^\ufffdO\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0006\ufffd\ufffdL\u06bc\ufffd\u0006\ufffd\ufffds\ufffdy\ufffd\u001d\ufffdwG\ufffd\ufffd\b\ufffdv\ufffdi\ufffdt*\u0016^\ufffdO\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0006\ufffd\ufffdL\u06bc\ufffd\u0006\ufffd\ufffds\ufffdy\ufffd\u001d\ufffdwG\ufffd\ufffd\b\ufffdv\ufffdi\ufffdt*\u0016^\ufffdO\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc573da81ef980ab9888a5c4f49e17ee7b239622",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0006\ufffd\ufffdL\u06bc\ufffd\u0006\ufffd\ufffds\ufffdy\ufffd\u001d\ufffdwG\ufffd\ufffd\b\ufffdv\ufffdi\ufffdt*\u0016^\ufffdO\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4157,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffdL\u06bc\ufffd\ufffd\ufffds\ufffdy\ufffd\ufffdwG\ufffd\ufffd\ufffdv\ufffdi\ufffdt*^\ufffdO\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4157 \u00b7 (reconnaissance)",
"target_port_label": "4157 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4157,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0006\ufffd\ufffdL\u06bc\ufffd\u0006\ufffd\ufffds\ufffdy\ufffd\u001d\ufffdwG\ufffd\ufffd\b\ufffdv\ufffdi\ufffdt*\u0016^\ufffdO\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4157,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4157 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffdL\u06bc\ufffd\ufffd\ufffds\ufffdy\ufffd\ufffdwG\ufffd\ufffd\ufffdv\ufffdi\ufffdt*^\ufffdO\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4157 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4157"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 340,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 340,
"scan_velocity_ports_per_s": 157.38,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3301 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3301 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3301
Chemin / cible
—
Service
TLS
Payload
{ w?��Sڱ�y��a�&�n��ʱ� k9uR� �5o �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w?��Sڱ�y��a�&�n��ʱ� k9uR� �5o �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.829234245337279,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3301,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c124267ad29c7ff39eac09442a4f00e7ce78f98a",
"event_fingerprint": "db1a9c61e9a4cc3662c17315ba83eee01c17bc57",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "849dc9c3aef7c532b4a55043c4893b10",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3301,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003?\ufffd\ufffdS\u06b1\ufffdy\u0004\ufffd\ufffda\u0005\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\u001e\ufffd5o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003?\ufffd\ufffdS\u06b1\ufffdy\u0004\ufffd\ufffda\u0005\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\u001e\ufffd5o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003?\ufffd\ufffdS\u06b1\ufffdy\u0004\ufffd\ufffda\u0005\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\u001e\ufffd5o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "377a9febc38a4e2282f92daee156248cc334460a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003?\ufffd\ufffdS\u06b1\ufffdy\u0004\ufffd\ufffda\u0005\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\u001e\ufffd5o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3301,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w?\ufffd\ufffdS\u06b1\ufffdy\ufffd\ufffda\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\ufffd5o\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3301 \u00b7 (reconnaissance)",
"target_port_label": "3301 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3301,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003?\ufffd\ufffdS\u06b1\ufffdy\u0004\ufffd\ufffda\u0005\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\u001e\ufffd5o\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3301,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3301 \u00b7 (reconnaissance)",
"evidence_snippet": "{w?\ufffd\ufffdS\u06b1\ufffdy\ufffd\ufffda\ufffd&\ufffdn\ufffd\ufffd\u02b1\ufffd\tk9uR\ufffd\ufffd5o\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3301 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3301"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 341,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 341,
"scan_velocity_ports_per_s": 157.4,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3460 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3460 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3460
Chemin / cible
—
Service
TLS
Payload
{ w�U��Ls���zHuv�8�X� �h��e>�Nt� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�U��Ls���zHuv�8�X� �h��e>�Nt� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.874301328502067,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3460,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "842e86cfce25e285065b2a5502d8b3622652eb35",
"event_fingerprint": "a275a13ab433161a7ee0e10212f4c5912a19fd7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "8fb8815bf4271d68cabfe75daa8bbd5c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3460,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdU\ufffd\ufffdLs\ufffd\ufffd\u001b\ufffd\u0017zHuv\ufffd8\ufffdX\ufffd\u001d\ufffdh\ufffd\ufffde>\ufffd\u0001Nt\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdU\ufffd\ufffdLs\ufffd\ufffd\u001b\ufffd\u0017zHuv\ufffd8\ufffdX\ufffd\u001d\ufffdh\ufffd\ufffde>\ufffd\u0001Nt\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdU\ufffd\ufffdLs\ufffd\ufffd\u001b\ufffd\u0017zHuv\ufffd8\ufffdX\ufffd\u001d\ufffdh\ufffd\ufffde>\ufffd\u0001Nt\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fde489cf2781e8e000a9511c8378aec13496c5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdU\ufffd\ufffdLs\ufffd\ufffd\u001b\ufffd\u0017zHuv\ufffd8\ufffdX\ufffd\u001d\ufffdh\ufffd\ufffde>\ufffd\u0001Nt\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3460,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffdU\ufffd\ufffdLs\ufffd\ufffd\ufffdzHuv\ufffd8\ufffdX\ufffd\ufffdh\ufffd\ufffde>\ufffdNt\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3460 \u00b7 (reconnaissance)",
"target_port_label": "3460 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3460,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffdU\ufffd\ufffdLs\ufffd\ufffd\u001b\ufffd\u0017zHuv\ufffd8\ufffdX\ufffd\u001d\ufffdh\ufffd\ufffde>\ufffd\u0001Nt\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3460,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3460 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffdU\ufffd\ufffdLs\ufffd\ufffd\ufffdzHuv\ufffd8\ufffdX\ufffd\ufffdh\ufffd\ufffde>\ufffdNt\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3460 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3460"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 342,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 342,
"scan_velocity_ports_per_s": 157.48,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4100 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4100 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4100
Chemin / cible
—
Service
TLS
Payload
{ w)D� �ߛ���3g)�'�����*�K�q�?� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w)D� �ߛ���3g)�'�����*�K�q�?� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.826184561543816,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4100,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3603d4d891b84d82d91c316ccfa4bed0237f711b",
"event_fingerprint": "2e652c7e02150b41133a28ccad6a0a8d7c828d18",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "945af5f1ce9834eb4e3f3d36c0c40863",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4100,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0002)D\ufffd\u001c\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\u0017\ufffd\ufffd\ufffd\ufffd*\ufffd\u0007K\ufffdq\ufffd?\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0002)D\ufffd\u001c\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\u0017\ufffd\ufffd\ufffd\ufffd*\ufffd\u0007K\ufffdq\ufffd?\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0002)D\ufffd\u001c\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\u0017\ufffd\ufffd\ufffd\ufffd*\ufffd\u0007K\ufffdq\ufffd?\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bac031ba135e47890d23ae5f6052d28e66f1fae8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0002)D\ufffd\u001c\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\u0017\ufffd\ufffd\ufffd\ufffd*\ufffd\u0007K\ufffdq\ufffd?\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4100,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w)D\ufffd\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdK\ufffdq\ufffd?\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4100 \u00b7 (reconnaissance)",
"target_port_label": "4100 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4100,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0002)D\ufffd\u001c\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\u0017\ufffd\ufffd\ufffd\ufffd*\ufffd\u0007K\ufffdq\ufffd?\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4100,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4100 \u00b7 (reconnaissance)",
"evidence_snippet": "{w)D\ufffd\ufffd\u07db\ufffd\ufffd\ufffd3g)\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdK\ufffdq\ufffd?\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4100 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 343,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 343,
"scan_velocity_ports_per_s": 157.55,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3702 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3702 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3702
Chemin / cible
—
Service
TLS
Payload
{ w[���[����F ��zH��$!>Jz -�� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w[���[����F
��zH��$!>Jz -�� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.650983270577166,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3702,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e91836f0d746c7d6589362f387330aafb7419bc1",
"event_fingerprint": "c5208d1f464e5ff78b0e9556146a46afa4501477",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "ac26ce907b3893b2aaedcbf287fb246b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3702,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\u0003\r\ufffd\ufffd\u0005\u0005zH\ufffd\ufffd$!>Jz\u0000\u0001-\ufffd\ufffd\u0018\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\u0003\r\ufffd\ufffd\u0005\u0005zH\ufffd\ufffd$!>Jz\u0000\u0001-\ufffd\ufffd\u0018\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\u0003\r\ufffd\ufffd\u0005\u0005zH\ufffd\ufffd$!>Jz\u0000\u0001-\ufffd\ufffd\u0018\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1984a2022f6c31fd2b30970c7f8e7efe401fe08",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\u0003\r\ufffd\ufffd\u0005\u0005zH\ufffd\ufffd$!>Jz\u0000\u0001-\ufffd\ufffd\u0018\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3702,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\r\ufffd\ufffdzH\ufffd\ufffd$!>Jz-\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3702 \u00b7 (reconnaissance)",
"target_port_label": "3702 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3702,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\u0003\r\ufffd\ufffd\u0005\u0005zH\ufffd\ufffd$!>Jz\u0000\u0001-\ufffd\ufffd\u0018\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3702,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3702 \u00b7 (reconnaissance)",
"evidence_snippet": "{w[\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdF\r\ufffd\ufffdzH\ufffd\ufffd$!>Jz-\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3702 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3702"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 344,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 344,
"scan_velocity_ports_per_s": 157.61,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3749 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:3749 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3749
Chemin / cible
—
Service
TLS
Payload
{ w\)�s*:p�e�I�M&�7� 8��M� f�.�Z � �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w\)�s*:p�e�I�M&�7� 8��M� f�.�Z � �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.863881421854986,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 3749,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "db69c761c741aee6aa62bffa734626f62c5b091a",
"event_fingerprint": "711f364857f2390f7ebe9f6cb7435b69c7e205af",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "0130b5870bc6e00067e9f412fda7937b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3749,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\)\ufffds\b*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd\u001c8\ufffd\ufffdM\ufffd\u0000f\ufffd.\ufffdZ\f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\)\ufffds\b*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd\u001c8\ufffd\ufffdM\ufffd\u0000f\ufffd.\ufffdZ\f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\)\ufffds\b*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd\u001c8\ufffd\ufffdM\ufffd\u0000f\ufffd.\ufffdZ\f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2831d2bd21325633dcfba11c247abc313c1d1a69",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\)\ufffds\b*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd\u001c8\ufffd\ufffdM\ufffd\u0000f\ufffd.\ufffdZ\f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3749,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\\)\ufffds*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd8\ufffd\ufffdM\ufffdf\ufffd.\ufffdZ\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:3749 \u00b7 (reconnaissance)",
"target_port_label": "3749 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3749,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\)\ufffds\b*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd\u001c8\ufffd\ufffdM\ufffd\u0000f\ufffd.\ufffdZ\f\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 3749,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:3749 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\\)\ufffds*:p\ufffde\ufffdI\ufffdM&\ufffd7\ufffd8\ufffd\ufffdM\ufffdf\ufffd.\ufffdZ\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "3749 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3749"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 345,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 345,
"scan_velocity_ports_per_s": 157.66,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
427 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:427 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
427
Chemin / cible
—
Service
TLS
Payload
{ w��� *��, ��O�ݢ[�6��Q �M�B�2� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w��� *��, ��O�ݢ[�6��Q
�M�B�2� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.811616141105823,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 427,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3427af323d17bd21396d12bcd5d53dfb8b31e674",
"event_fingerprint": "be6779db61f2b1cb4adc0a52493ceacb2fe7b797",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "cb4473854af7788795f276f781369eca",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 427,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u001e*\ufffd\u0007\ufffd,\u0000\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\u000f\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u001e*\ufffd\u0007\ufffd,\u0000\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\u000f\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u001e*\ufffd\u0007\ufffd,\u0000\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\u000f\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9c285ff009c940fc7bc03ebc78cbad70ed6e9fc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u001e*\ufffd\u0007\ufffd,\u0000\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\u000f\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 427,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd*\ufffd\ufffd,\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:427 \u00b7 (reconnaissance)",
"target_port_label": "427 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 427,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\ufffd\ufffd\u001e*\ufffd\u0007\ufffd,\u0000\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\u000f\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 427,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:427 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd*\ufffd\ufffd,\ufffd\ufffdO\ufffd\u0762[\ufffd6\ufffd\ufffdQ\r\ufffdM\ufffdB\ufffd2\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "427 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 346,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 346,
"scan_velocity_ports_per_s": 156.01,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4321 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4321 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4321
Chemin / cible
—
Service
TLS
Payload
{ w���v����g���S45H�����.B:�B �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w���v����g���S45H�����.B:�B �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.814389444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4321,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cebef40336c6fa7fc7a1df89623836f5b34508ef",
"event_fingerprint": "25b102ee35b0a85844f498458a353791c2a4da94",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "c32f8d19fb9499cd5add61d0c1766840",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4321,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0011\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\u0006g\ufffd\ufffd\ufffd\u001aS45\u000eH\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0011\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\u0006g\ufffd\ufffd\ufffd\u001aS45\u000eH\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0011\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\u0006g\ufffd\ufffd\ufffd\u001aS45\u000eH\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8dbaf29b45cf3d0cb380ad31f5a7540415e37343",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0011\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\u0006g\ufffd\ufffd\ufffd\u001aS45\u000eH\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4321,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffdS45H\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4321 \u00b7 (reconnaissance)",
"target_port_label": "4321 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4321,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0011\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\u0006g\ufffd\ufffd\ufffd\u001aS45\u000eH\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4321,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4321 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffdS45H\ufffd\ufffd\ufffd\ufffd\ufffd.B:\ufffdB\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4321 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4321"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 347,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 347,
"scan_velocity_ports_per_s": 156.08,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4282 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4282 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4282
Chemin / cible
—
Service
TLS
Payload
{ w�@�6���}-?ﾼh+�b�ت\��\�| �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�@�6���}-?ﾼh+�b�ت\��\�| �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.807711686726627,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4282,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5c0e4dbffceec0296daff8982237c382ca0db273",
"event_fingerprint": "024dc3f62ed0fa558e9c69e2b75ed15c29dee6d2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "8ca4ffd45d45af98094966150292a539",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4282,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd@\ufffd\u00116\ufffd\ufffd\ufffd}-?\u0014\uffbch+\u0004\ufffdb\ufffd\u062a\\\ufffd\u0005\ufffd\\\ufffd| \u0014\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd@\ufffd\u00116\ufffd\ufffd\ufffd}-?\u0014\uffbch+\u0004\ufffdb\ufffd\u062a\\\ufffd\u0005\ufffd\\\ufffd| \u0014\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd@\ufffd\u00116\ufffd\ufffd\ufffd}-?\u0014\uffbch+\u0004\ufffdb\ufffd\u062a\\\ufffd\u0005\ufffd\\\ufffd| \u0014\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bce767f7b247a9be5fc47f58edb88680da932055",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd@\ufffd\u00116\ufffd\ufffd\ufffd}-?\u0014\uffbch+\u0004\ufffdb\ufffd\u062a\\\ufffd\u0005\ufffd\\\ufffd| \u0014\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4282,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd@\ufffd6\ufffd\ufffd\ufffd}-?\uffbch+\ufffdb\ufffd\u062a\\\ufffd\ufffd\\\ufffd| \ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4282 \u00b7 (reconnaissance)",
"target_port_label": "4282 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4282,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd@\ufffd\u00116\ufffd\ufffd\ufffd}-?\u0014\uffbch+\u0004\ufffdb\ufffd\u062a\\\ufffd\u0005\ufffd\\\ufffd| \u0014\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4282,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4282 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd@\ufffd6\ufffd\ufffd\ufffd}-?\uffbch+\ufffdb\ufffd\u062a\\\ufffd\ufffd\\\ufffd| \ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4282 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4282"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 348,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 348,
"scan_velocity_ports_per_s": 156.16,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4244 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4244 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4244
Chemin / cible
—
Service
TLS
Payload
{ wɌ�Rf @ FU���4?9j�D��e�;Ѱ �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ wɌ�Rf @ FU���4?9j�D��e�;Ѱ �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.792086686726627,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4244,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c67ef657a2dfad7397437fb0b0f4a14739f61621",
"event_fingerprint": "e53d2f138542c61229d172295e9055c229583a64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "a2890e95433cf7bcb0ff8083a4ea88d0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4244,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u024c\ufffdRf\u001c@\u0012\u000bFU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd\u0002\u001b;\u0470\u0012\u0005\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u024c\ufffdRf\u001c@\u0012\u000bFU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd\u0002\u001b;\u0470\u0012\u0005\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u024c\ufffdRf\u001c@\u0012\u000bFU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd\u0002\u001b;\u0470\u0012\u0005\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33653dcfa1a39b2a7087e47ec0365bc8b820de9d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u024c\ufffdRf\u001c@\u0012\u000bFU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd\u0002\u001b;\u0470\u0012\u0005\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4244,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\u024c\ufffdRf@FU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd;\u0470\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4244 \u00b7 (reconnaissance)",
"target_port_label": "4244 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (64 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4244,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u024c\ufffdRf\u001c@\u0012\u000bFU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd\u0002\u001b;\u0470\u0012\u0005\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4244,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4244 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\u024c\ufffdRf@FU\ufffd\ufffd\ufffd4?9j\ufffdD\ufffd\ufffde\ufffd;\u0470\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4244 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4244"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 349,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
104,
106,
111,
119,
122,
137,
139,
175,
179
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 349,
"scan_velocity_ports_per_s": 156.2,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 64,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
43 · WHOIS
|
whois
|
Scan de ports
port scan syn · via WHOIS:43 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
WHOIS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
43
Chemin / cible
—
Service
WHOIS
Payload
{ w���/ �j>' ����ā�mK7D��q,o : �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w���/ �j>' ����ā�mK7D��q,o
: �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "252057484f495320686f6e6579706f740d0a446f6d61696e3a206578616d706c652e636f6d0d0a",
"emulator_response_len": 39,
"bytes_in": 128,
"payload_entropy": 4.810559561543816,
"port_category": "well_known",
"org": "Unmanaged Ltd",
"service": "whois",
"app_proto": "whois",
"asn": 47890,
"country": "RO",
"dst_port": 43,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "eed3bee913272624531f9c449f66dfba7c72a4de",
"event_fingerprint": "70f2213e377b9478c22e7dcca8927ba705ea7cec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "whois",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "12554ded190c33699e87815cce53a40a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 43,
"service": "whois",
"service_name": "whois",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0012\ufffd\ufffd\u0010\/ \ufffdj>'\u001f\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,\u0002\u0004o\r:\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0012\ufffd\ufffd\u0010\/ \ufffdj>'\u001f\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,\u0002\u0004o\r:\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0012\ufffd\ufffd\u0010\/ \ufffdj>'\u001f\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,\u0002\u0004o\r:\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "175457a8d72344e152c23e38f8b43911faa33e9d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0012\ufffd\ufffd\u0010\/ \ufffdj>'\u001f\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,\u0002\u0004o\r:\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 43,
"service": "whois",
"service_label_fr": "WHOIS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffd\/ \ufffdj>'\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,o\r:\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via WHOIS:43 \u00b7 (reconnaissance)",
"target_port_label": "43 \u00b7 WHOIS",
"emulator_service": "whois",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WHOIS \u2014 multi-protocole (65 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "whois",
"service_label_fr": "WHOIS",
"dst_port": 43,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-whois",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd\u0012\ufffd\ufffd\u0010\/ \ufffdj>'\u001f\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,\u0002\u0004o\r:\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 43,
"service": "whois",
"service_label_fr": "WHOIS"
},
"attack_vector": "port scan syn \u00b7 via WHOIS:43 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffd\/ \ufffdj>'\ufffd\ufffd\ufffd\ufffd\u0101\ufffdmK7D\ufffd\ufffdq,o\r:\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "43 \u00b7 WHOIS",
"emulator_service": "whois",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "whois",
"service_banner": "honeypot-whois",
"service_os": "linux",
"dst_port": "43"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 350,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
104,
106,
111,
119,
122,
137,
139,
175
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 350,
"scan_velocity_ports_per_s": 156.24,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 65,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_clienthello"
]
}
|
|
|
TCP |
4344 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4344 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4344
Chemin / cible
—
Service
TLS
Payload
{ w�|���lzFԸ�+(�������Z�(�<ʊW=� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w�|���lzFԸ�+(�������Z�(�<ʊW=� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.845639444322512,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4344,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bc83ca00feb1442e59bc4649c7ccc2ade9c47c39",
"event_fingerprint": "ee11c64ff407eefd184b72d7d83738bea3ddd201",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "fc057125456c86b8d880f0b7216de2ce",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4344,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd|\ufffd\ufffd\ufffdlz\bF\u0538\ufffd+(\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd|\ufffd\ufffd\ufffdlz\bF\u0538\ufffd+(\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd|\ufffd\ufffd\ufffdlz\bF\u0538\ufffd+(\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd3844d7a8b7c437f39cbed0249bc0ac1e7e0988",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd|\ufffd\ufffd\ufffdlz\bF\u0538\ufffd+(\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4344,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd|\ufffd\ufffd\ufffdlzF\u0538\ufffd+(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4344 \u00b7 (reconnaissance)",
"target_port_label": "4344 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (65 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4344,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\ufffd|\ufffd\ufffd\ufffdlz\bF\u0538\ufffd+(\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4344,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4344 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd|\ufffd\ufffd\ufffdlzF\u0538\ufffd+(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd(\ufffd<\u028aW=\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4344 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4344"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 351,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
104,
106,
111,
119,
122,
137,
139,
175
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 351,
"scan_velocity_ports_per_s": 156.28,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 65,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4461 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4461 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cba7f34191ef2379
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4461
Chemin / cible
—
Service
TLS
Payload
{ w ��� n!�L����.Wk��n� �@�H&q� �/�+���� �� / 5� 4 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
{ w ��� n!�L����.Wk��n� �@�H&q� �/�+���� ��
/ 5�
4
�
Meta JSON brut
{
"tls_ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 6,
"bytes_in": 128,
"payload_entropy": 4.863881421854986,
"port_category": "registered",
"org": "Unmanaged Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 47890,
"country": "RO",
"dst_port": 4461,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "35d6499c93dda779aa5085e4bc624b1f1bb00335",
"event_fingerprint": "7e09843de14f39ed45e3792b147559c2e633075f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RO",
"asn": 47890,
"org": "Unmanaged Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"payload_hash": "e43ce757f465683a246cdfdc827e5aab",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3a5f53d3656a0df675e8aa020d5979e",
"tls_ja4": "t13d0113_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4461,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001d\ufffd\ufffd\ufffd\u0000n!\u0014\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\u001f\ufffd@\ufffdH&q\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001d\ufffd\ufffd\ufffd\u0000n!\u0014\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\u001f\ufffd@\ufffdH&q\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001d\ufffd\ufffd\ufffd\u0000n!\u0014\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\u001f\ufffd@\ufffdH&q\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f57cb1630f0529366e89991eae02c126ae308265",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001d\ufffd\ufffd\ufffd\u0000n!\u0014\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\u001f\ufffd@\ufffdH&q\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4461,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "{w\ufffd\ufffd\ufffdn!\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\ufffd@\ufffdH&q\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4461 \u00b7 (reconnaissance)",
"target_port_label": "4461 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (65 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4461,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u001d\ufffd\ufffd\ufffd\u0000n!\u0014\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\u001f\ufffd@\ufffdH&q\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cba7f34191ef2379c1325641f6c6c4f4",
"tls_ja4": "a3a5f53d3656a0df675e8aa020d5979e",
"port": 4461,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4461 \u00b7 (reconnaissance)",
"evidence_snippet": "{w\ufffd\ufffd\ufffdn!\ufffdL\ufffd\ufffd\ufffd\ufffd.Wk\ufffd\ufffdn\ufffd\ufffd@\ufffdH&q\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd",
"target_port_label": "4461 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4461"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 352,
"port_scan_ports_sample": [
11,
13,
15,
17,
19,
26,
37,
43,
104,
106,
111,
119,
122,
137,
139,
175
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 352,
"scan_velocity_ports_per_s": 156.33,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"game",
"medical",
"ot",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 65,
"multi_protocol_sample": [
"bgp",
"chargen",
"cics-alt",
"cloudflare-tunnel",
"couchbase",
"cpanel",
"cpanel-ssl",
"cpanel-whm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|