|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
Scan de ports
port scan syn · via ORACLE EM:7443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_em_emulated
oracle_em_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Service
ORACLE EM
Payload
�j�S����e˄���;W��\��oc^�� �+ �ޡ@~�(z�ΔZ"3�"<AIGs�-T��+�s� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +19
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�j�S����e˄���;W��\��oc^��
�+ �ޡ@~�(z�ΔZ"3�"<AIGs�-T��+�s� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�j�S����e˄���;W��\��oc^�� �+ �ޡ@~�(z�ΔZ"3�"<AIGs�-T��+�s� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �������)&wL�Be
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.834415577812507,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "oracle-em",
"app_proto": "oracle-em",
"asn": 215540,
"country": "IQ",
"dst_port": 7443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b",
"event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"named_classification_skipped": false,
"service_name": "oracle-em",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "27a4d07503e254a9d4d2272b927d7363",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7443,
"service": "oracle-em",
"service_name": "oracle-em",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003j\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;\u001aW\ufffd\ufffd\\\ufffd\u0002\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\u001a\ufffd-\u0002T\ufffd\ufffd+\ufffds\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003j\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;\u001aW\ufffd\ufffd\\\ufffd\u0002\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\u001a\ufffd-\u0002T\ufffd\ufffd+\ufffds\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)&\u000ewL\ufffdBe",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003j\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;\u001aW\ufffd\ufffd\\\ufffd\u0002\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\u001a\ufffd-\u0002T\ufffd\ufffd+\ufffds\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad1e30db29cc0db589a93d8576d0f45adec7bc91",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003j\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;\u001aW\ufffd\ufffd\\\ufffd\u0002\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\u001a\ufffd-\u0002T\ufffd\ufffd+\ufffds\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"evidence_snippet": "\ufffdj\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;W\ufffd\ufffd\\\ufffd\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\ufffd-T\ufffd\ufffd+\ufffds\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ORACLE EM \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "oracle-em",
"service_label_fr": "ORACLE EM",
"dst_port": 7443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle-em",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +19",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003j\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;\u001aW\ufffd\ufffd\\\ufffd\u0002\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\u001a\ufffd-\u0002T\ufffd\ufffd+\ufffds\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdj\ufffdS\ufffd\ufffd\ufffd\ufffde\u02c4\ufffd\ufffd\ufffd;W\ufffd\ufffd\\\ufffd\ufffdoc^\ufffd\ufffd\u05fc\r\ufffd+ \ufffd\u07a1@~\ufffd(z\ufffd\u0394Z\"3\ufffd\"<AIGs\ufffd-T\ufffd\ufffd+\ufffds\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle_em",
"service_banner": "honeypot-oracle-em",
"service_os": "linux",
"dst_port": "7443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 19,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_oracle_tns_probe",
"oracle_em_emulated",
"oracle_em_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Scan de ports
port scan syn · via K8S API:6443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
��&o)R�[TWCh�1"+J}E$H��h6 4��w '�ve��s �4ߞ��w=>.39\��H��ǒ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��&o)R�[TWCh�1"+J}E$H��h6 4��w '�ve��s �4ߞ��w=>.39\��H��ǒ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��&o)R�[TWCh�1"+J}E$H��h6 4��w '�ve��s �4ߞ��w=>.39\��H��ǒ $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �a@ۉP�B$�����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 517,
"payload_entropy": 3.7832659322064908,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 215540,
"country": "IQ",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dc7e05cefde774fc860fba4ed232f0b4861f076e",
"event_fingerprint": "1eeecffdeefbfbad05a3604bc614efa2174b97bf",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bf09e5924f2faf7e6f33d1855139da7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd&o)R\ufffd[TWCh\ufffd1\"\u0001+J}E$H\ufffd\u0001\ufffdh6\u001f4\u0006\ufffd\ufffdw '\ufffdve\ufffd\ufffds\f\u0000\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd&o)R\ufffd[TWCh\ufffd1\"\u0001+J}E$H\ufffd\u0001\ufffdh6\u001f4\u0006\ufffd\ufffdw '\ufffdve\ufffd\ufffds\f\u0000\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0014\ufffda@\u06c9P\ufffdB$\ufffd\ufffd\ufffd\ufffd\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd&o)R\ufffd[TWCh\ufffd1\"\u0001+J}E$H\ufffd\u0001\ufffdh6\u001f4\u0006\ufffd\ufffdw '\ufffdve\ufffd\ufffds\f\u0000\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e06b26cbf111107b537302b3f50ea9c72d69e54a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd&o)R\ufffd[TWCh\ufffd1\"\u0001+J}E$H\ufffd\u0001\ufffdh6\u001f4\u0006\ufffd\ufffdw '\ufffdve\ufffd\ufffds\f\u0000\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "\ufffd\ufffd&o)R\ufffd[TWCh\ufffd1\"+J}E$H\ufffd\ufffdh64\ufffd\ufffdw '\ufffdve\ufffd\ufffds\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via K8S API \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd&o)R\ufffd[TWCh\ufffd1\"\u0001+J}E$H\ufffd\u0001\ufffdh6\u001f4\u0006\ufffd\ufffdw '\ufffdve\ufffd\ufffds\f\u0000\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd&o)R\ufffd[TWCh\ufffd1\"+J}E$H\ufffd\ufffdh64\ufffd\ufffdw '\ufffdve\ufffd\ufffds\ufffd4\u07de\ufffd\ufffdw=>.39\\\ufffd\ufffdH\ufffd\ufffd\u01d2$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.8,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
444 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:444 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
444
Chemin / cible
—
Service
TLS
Payload
��%�!�?0G���f���m9�w�˶z7������� m�-aP�"��~����EI!�@t,�$|,�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��%�!�?0G���f���m9�w�˶z7�������
m�-aP�"��~����EI!�@t,�$|,�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��%�!�?0G���f���m9�w�˶z7������� m�-aP�"��~����EI!�@t,�$|,�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �pD @W�G�9�4�3
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.7826936441288304,
"port_category": "well_known",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9bff362b5e4b1fc54e3e921cb3112e46219b6d26",
"event_fingerprint": "53037cabb7eb283054b9536ef8ee73f94e084f70",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "93369e67d8bee0ab2c5ac1eb311fd3f5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 444,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\u001a\ufffd-\u0013aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\u0006\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd\f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\u001a\ufffd-\u0013aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\u0006\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd\f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdpD\u001d@W\ufffdG\ufffd9\u0017\ufffd4\ufffd\u00063",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\u001a\ufffd-\u0013aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\u0006\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd\f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59685666a8946f44879c0d4a9a8e75f209873ce9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\u001a\ufffd-\u0013aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\u0006\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd\f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 444,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\ufffd-aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:444 \u00b7 (reconnaissance)",
"target_port_label": "444 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 444,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\u001a\ufffd-\u0013aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\u0006\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd\f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 444,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:444 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd%\ufffd!\ufffd?0G\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffdm9\ufffdw\ufffd\u02f6z7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \nm\ufffd-aP\ufffd\"\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdEI!\ufffd@t,\ufffd$|,\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "444 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.2,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
11443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:11443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11443
Chemin / cible
—
Service
TLS
Payload
���F+� s���`9�c>��֏BāuOt-a*�H d����-�e��;I�1vjek*+v9 ���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���F+� s���`9�c>��֏BāuOt-a*�H
d����-�e��;I�1vjek*+v9 ���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
���F+� s���`9�c>��֏BāuOt-a*�H d����-�e��;I�1vjek*+v9 ���� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ��YCb+ �U+C
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.764537315409463,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 11443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d7ec2422c6e6f404ff801e8ea89fcd8f78d1e50e",
"event_fingerprint": "7ef8570a341bb638ba7324f6d4e55b06c5fd34df",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "865561885e98a7a4052876ee130906a2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 11443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdF+\ufffd\ts\ufffd\u0017\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\u0019\ufffd\ufffd\u001a\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vje\u0006k*+v9\f\ufffd\ufffd\ufffd\ufffd\u001f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdF+\ufffd\ts\ufffd\u0017\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\u0019\ufffd\ufffd\u001a\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vje\u0006k*+v9\f\ufffd\ufffd\ufffd\ufffd\u001f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0018\ufffdYCb+\r\u0019\u0018\ufffdU+C",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdF+\ufffd\ts\ufffd\u0017\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\u0019\ufffd\ufffd\u001a\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vje\u0006k*+v9\f\ufffd\ufffd\ufffd\ufffd\u001f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b95e6409cdadcdaaea43bf0c3330b49867562356",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdF+\ufffd\ts\ufffd\u0017\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\u0019\ufffd\ufffd\u001a\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vje\u0006k*+v9\f\ufffd\ufffd\ufffd\ufffd\u001f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 11443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdF+\ufffd\ts\ufffd\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\ufffd\ufffd\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vjek*+v9\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:11443 \u00b7 (reconnaissance)",
"target_port_label": "11443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 11443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdF+\ufffd\ts\ufffd\u0017\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\u0019\ufffd\ufffd\u001a\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vje\u0006k*+v9\f\ufffd\ufffd\ufffd\ufffd\u001f\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 11443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:11443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdF+\ufffd\ts\ufffd\ufffd\ufffd`9\ufffdc>\ufffd\ufffd\u058fB\u0101uOt-a*\ufffdH\n d\ufffd\ufffd\ufffd\ufffd-\ufffde\ufffd\ufffd;I\ufffd1vjek*+v9\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "11443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "11443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.38,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
4433 · QUIC HTTP3 STUB
|
quic-http3-stub
|
Scan de ports
port scan syn · via QUIC HTTP3 STUB:4433 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
QUIC-HTTP3-STUB
WAF
—
Recommandation
Surveiller
Tags
net_quic_probe
quic_http3_stub_emulated
quic_http3_stub_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4433
Chemin / cible
—
Service
QUIC HTTP3 STUB
Payload
��/�� HUv5���� ]Qs��^\�O�w��I �\��9�G.�- ����;zz�~+j��އ1�4��� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��/��
HUv5���� ]Qs��^\�O�w��I �\��9�G.�- ����;zz�~+j��އ1�4��� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��/�� HUv5���� ]Qs��^\�O�w��I �\��9�G.�- ����;zz�~+j��އ1�4��� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �˪�T��vA��/c�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0c00000000485454502f3320686f6e6579706f7420737475620d0a",
"emulator_response_len": 27,
"bytes_in": 517,
"payload_entropy": 3.796432388931022,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "quic-http3-stub",
"app_proto": "quic-http3-stub",
"asn": 215540,
"country": "IQ",
"dst_port": 4433,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a8bd063f644b84e1de1a05db0b9f17e832ed6e2d",
"event_fingerprint": "69ec763c111675fc5207ef508e4abdef0f3279d4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "quic-http3-stub",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8526e7ca3ae0866b43c2de0835b22005",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4433,
"service": "quic-http3-stub",
"service_name": "quic-http3-stub",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\/\ufffd\u0002\ufffd\rHU\u0017v\u00055\ufffd\ufffd\ufffd\ufffd\u001e]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\/\ufffd\u0002\ufffd\rHU\u0017v\u00055\ufffd\ufffd\ufffd\ufffd\u001e]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u02ea\ufffdT\ufffd\ufffdvA\ufffd\ufffd\/\u0019c\ufffd\u0014",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\/\ufffd\u0002\ufffd\rHU\u0017v\u00055\ufffd\ufffd\ufffd\ufffd\u001e]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4346bc8f4482b05fdd8145ac791ba44c56dcb540",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\/\ufffd\u0002\ufffd\rHU\u0017v\u00055\ufffd\ufffd\ufffd\ufffd\u001e]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\rHUv5\ufffd\ufffd\ufffd\ufffd]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (reconnaissance)",
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via QUIC HTTP3 STUB \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB",
"dst_port": 4433,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-quic-http3-stub",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\/\ufffd\u0002\ufffd\rHU\u0017v\u00055\ufffd\ufffd\ufffd\ufffd\u001e]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"attack_vector": "port scan syn \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\rHUv5\ufffd\ufffd\ufffd\ufffd]Qs\ufffd\ufffd^\\\ufffdO\ufffdw\ufffd\ufffdI \ufffd\\\ufffd\ufffd9\ufffdG.\ufffd-\t\ufffd\ufffd\ufffd\ufffd;zz\ufffd~+j\ufffd\ufffd\u07871\ufffd4\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "quic_http3_stub",
"service_banner": "honeypot-quic-http3-stub",
"service_os": "linux",
"dst_port": "4433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.24,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_quic_probe",
"quic_http3_stub_emulated",
"quic_http3_stub_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
Scan de ports
port scan syn · via PHAROS:4443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
�I�tqR QU{Z��>��z�u���a��<� �ؕ6��bh �G�s��lX º𧻓�۽"�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�I�tqR
QU{Z��>��z�u���a��<� �ؕ6��bh �G�s��lX º𧻓�۽"�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�I�tqR QU{Z��>��z�u���a��<� �ؕ6��bh �G�s��lX º𧻓�۽"�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ n3!_ �h�'�?�,��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.8046615977147975,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "pharos",
"app_proto": "pharos",
"asn": 215540,
"country": "IQ",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "89561f8f318c80172012490c044505a5754a6ac2",
"event_fingerprint": "a96ca122b1bad4ccd48bb63eb9aef3278fab388b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "pharos",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8f8b106a74eece5b99e5e44455339628",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003I\ufffd\u0012tqR\u001b\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\u0006\ufffdu\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd<\ufffd\u0017 \ufffd\u06156\ufffd\ufffdb\u0001h\u0000\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\u0005\ufffd\u06fd\"\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003I\ufffd\u0012tqR\u001b\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\u0006\ufffdu\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd<\ufffd\u0017 \ufffd\u06156\ufffd\ufffdb\u0001h\u0000\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\u0005\ufffd\u06fd\"\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 n3!_\u000b\u001b\ufffdh\ufffd'\ufffd?\ufffd,\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003I\ufffd\u0012tqR\u001b\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\u0006\ufffdu\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd<\ufffd\u0017 \ufffd\u06156\ufffd\ufffdb\u0001h\u0000\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\u0005\ufffd\u06fd\"\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54191bf2a4695a82b0833956e3ea2a7107b69373",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003I\ufffd\u0012tqR\u001b\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\u0006\ufffdu\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd<\ufffd\u0017 \ufffd\u06156\ufffd\ufffdb\u0001h\u0000\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\u0005\ufffd\u06fd\"\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffdI\ufffdtqR\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\ufffdu\ufffd\ufffd\ufffda\ufffd\ufffd<\ufffd \ufffd\u06156\ufffd\ufffdbh\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\ufffd\u06fd\"\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via PHAROS:4443 \u00b7 (reconnaissance)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PHAROS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003I\ufffd\u0012tqR\u001b\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\u0006\ufffdu\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd<\ufffd\u0017 \ufffd\u06156\ufffd\ufffdb\u0001h\u0000\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\u0005\ufffd\u06fd\"\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "port scan syn \u00b7 via PHAROS:4443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdI\ufffdtqR\rQU{Z\ufffd\ufffd>\ufffd\ufffdz\ufffdu\ufffd\ufffd\ufffda\ufffd\ufffd<\ufffd \ufffd\u06156\ufffd\ufffdbh\ufffdG\ufffds\ufffd\ufffdlX \u00ba\ufad7\ufffd\u06fd\"\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.95,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
15443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15443
Chemin / cible
—
Service
TLS
Payload
�G�Z����Xg)��/��|}i*e\EˠÔ�-�m ٸ�$վ7��n������J�NK9��%M�:� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�G�Z����Xg)��/��|}i*e\EˠÔ�-�m ٸ�$վ7��n������J�NK9��%M�:� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�G�Z����Xg)��/��|}i*e\EˠÔ�-�m ٸ�$վ7��n������J�NK9��%M�:� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �(W��&�{}8�|�(a
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.797096129052684,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 15443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4a9700529e0632b6372128ac6e9f6548036dc85b",
"event_fingerprint": "d66b0965ad46ace10c505237fcbd4be98d507035",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "c3cf4881ae5c2c0ef7552e323dc58799",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G\ufffdZ\ufffd\ufffd\ufffd\ufffdX\u0013g)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u0018\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffdJ\ufffdN\u0016K9\ufffd\u0003\ufffd%M\ufffd:\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G\ufffdZ\ufffd\ufffd\ufffd\ufffdX\u0013g)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u0018\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffdJ\ufffdN\u0016K9\ufffd\u0003\ufffd%M\ufffd:\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd(W\ufffd\ufffd&\ufffd{}8\ufffd|\ufffd(\u0007a",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G\ufffdZ\ufffd\ufffd\ufffd\ufffdX\u0013g)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u0018\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffdJ\ufffdN\u0016K9\ufffd\u0003\ufffd%M\ufffd:\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "104a082cde1c5c805ebc14cbd184887e154edac1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G\ufffdZ\ufffd\ufffd\ufffd\ufffdX\u0013g)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u0018\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffdJ\ufffdN\u0016K9\ufffd\u0003\ufffd%M\ufffd:\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 15443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdG\ufffdZ\ufffd\ufffd\ufffd\ufffdXg)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffdNK9\ufffd\ufffd%M\ufffd:\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15443 \u00b7 (reconnaissance)",
"target_port_label": "15443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G\ufffdZ\ufffd\ufffd\ufffd\ufffdX\u0013g)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u0018\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffdJ\ufffdN\u0016K9\ufffd\u0003\ufffd%M\ufffd:\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 15443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdG\ufffdZ\ufffd\ufffd\ufffd\ufffdXg)\ufffd\ufffd\/\ufffd\ufffd|}i*e\\E\u02e0\u00d4\ufffd-\ufffdm \u0678\ufffd$\u057e7\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffdNK9\ufffd\ufffd%M\ufffd:\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "15443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.86,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
10443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:10443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10443
Chemin / cible
—
Service
HTTPS
Payload
�HB.MJ�&G�F�j��h���<��#1 C�<�o�Qչ`�FG���d�T������X�3 $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�HB.MJ�&G�F�j��h���<��#1 C�<�o�Qչ`�FG���d�T������X�3 $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�HB.MJ�&G�F�j��h���<��#1 C�<�o�Qչ`�FG���d�T������X�3 $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ )�np3��wA) ď�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.769891232406127,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 10443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "51e0ea2696eb47d933501e9e4e547b380a3777d9",
"event_fingerprint": "7127e0cbe7d6c99cc93e9927b8c66f5194e98327",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ad2c29c8d6c0256dd357bf40f80f9d8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bHB.MJ\u0002\ufffd\u0003\u0010\u0002&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\u0016\ufffd\ufffd<\u0014\ufffd\ufffd\u000e#\u00151 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffd\u0014FG\ufffd\u0019\ufffd\ufffdd\ufffdT\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0011\ufffdX\ufffd3\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bHB.MJ\u0002\ufffd\u0003\u0010\u0002&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\u0016\ufffd\ufffd<\u0014\ufffd\ufffd\u000e#\u00151 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffd\u0014FG\ufffd\u0019\ufffd\ufffdd\ufffdT\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0011\ufffdX\ufffd3\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0013\u0003)\ufffdnp3\ufffd\ufffdwA)\u001c\u010f\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bHB.MJ\u0002\ufffd\u0003\u0010\u0002&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\u0016\ufffd\ufffd<\u0014\ufffd\ufffd\u000e#\u00151 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffd\u0014FG\ufffd\u0019\ufffd\ufffdd\ufffdT\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0011\ufffdX\ufffd3\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "deb69248517e2cb2376c1d1dbeef8f159a70b5d2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bHB.MJ\u0002\ufffd\u0003\u0010\u0002&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\u0016\ufffd\ufffd<\u0014\ufffd\ufffd\u000e#\u00151 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffd\u0014FG\ufffd\u0019\ufffd\ufffdd\ufffdT\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0011\ufffdX\ufffd3\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffdHB.MJ\ufffd&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\ufffd\ufffd<\ufffd\ufffd#1 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffdFG\ufffd\ufffd\ufffdd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd3$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 10443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bHB.MJ\u0002\ufffd\u0003\u0010\u0002&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\u0016\ufffd\ufffd<\u0014\ufffd\ufffd\u000e#\u00151 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffd\u0014FG\ufffd\u0019\ufffd\ufffdd\ufffdT\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0011\ufffdX\ufffd3\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdHB.MJ\ufffd&G\ufffdF\ufffdj\ufffd\ufffdh\ufffd\ufffd\ufffd<\ufffd\ufffd#1 C\ufffd<\ufffdo\ufffdQ\u0579`\ufffdFG\ufffd\ufffd\ufffdd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd3$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "10443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 2.17,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
4444 · I2P
|
i2p
|
Scan de ports
port scan syn · via I2P:4444 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
I2P
WAF
—
Recommandation
Surveiller
Tags
i2p_emulated
i2p_payload
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4444
Chemin / cible
—
Service
I2P
Payload
��r.�)�������#�#�Q,�}T� �KS5% � GإT�Dп����ӕF�J�l �UHK������T $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +19
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��r.�)�������#�#�Q,�}T�
�KS5% � GإT�Dп����ӕF�J�l �UHK������T $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��r.�)�������#�#�Q,�}T� �KS5% � GإT�Dп����ӕF�J�l �UHK������T $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ `R�7�{ ��VH(2�=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000010000000000000000000000000",
"emulator_response_len": 16,
"bytes_in": 517,
"payload_entropy": 3.8280422057893007,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "i2p",
"app_proto": "i2p",
"asn": 215540,
"country": "IQ",
"dst_port": 4444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "885afc5173e73d5c371f0f24598cf71d18f6646a",
"event_fingerprint": "224cfca4a6c8c760d0188870f2e00ca179f5976e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"named_classification_skipped": false,
"service_name": "i2p",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a85f9695a7e289c16f9c1fddec4f55f7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4444,
"service": "i2p",
"service_name": "i2p",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \u001c\ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\u001e\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \u001c\ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\u001e\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 `R\ufffd7\u0014\ufffd{ \ufffd\ufffdVH(2\ufffd=",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \u001c\ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\u001e\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "592962964dfafe0fe66fc0096a3aaf9a7cf198f4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \u001c\ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\u001e\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"evidence_snippet": "\ufffd\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via I2P \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "i2p",
"service_label_fr": "I2P",
"dst_port": 4444,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-i2p",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +19",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \u001c\ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\u001e\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdr.\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd#\ufffdQ,\ufffd}T\ufffd\n\ufffdKS5% \ufffd G\u0625T\ufffdD\u043f\ufffd\ufffd\ufffd\ufffd\u04d5F\ufffdJ\ufffdl\ufffdUHK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "i2p",
"service_banner": "honeypot-i2p",
"service_os": "linux",
"dst_port": "4444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 19,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"i2p_emulated",
"i2p_payload",
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
�[��I; ��b��@I� �R2 �]�pcX :�* rm��l�,c��]J�x����M\:.2�;S�f* $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
�[��I;
��b��@I� �R2 �]�pcX
:�* rm��l�,c��]J�x����M\:.2�;S�f* $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�[��I; ��b��@I� �R2 �]�pcX :�* rm��l�,c��]J�x����M\:.2�;S�f* $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ B���tMo���=J��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.778407551433757,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5216dccdba349f4933cc4a66900c72f3e115102d",
"event_fingerprint": "66de93e93356302b7cdade60cabf69b7305865e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6522df28311037be0c73bef56bfcf3af",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\ufffd\ufffdI;\r\ufffd\ufffd\u0012b\ufffd\ufffd@I\ufffd\t\ufffdR2\u0000\ufffd]\u001b\ufffdpc\bX\n:\ufffd* rm\ufffd\u0011\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\ufffd\ufffdI;\r\ufffd\ufffd\u0012b\ufffd\ufffd@I\ufffd\t\ufffdR2\u0000\ufffd]\u001b\ufffdpc\bX\n:\ufffd* rm\ufffd\u0011\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 B\ufffd\ufffd\ufffdtMo\ufffd\ufffd\ufffd\u0016\u0004=J\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\ufffd\ufffdI;\r\ufffd\ufffd\u0012b\ufffd\ufffd@I\ufffd\t\ufffdR2\u0000\ufffd]\u001b\ufffdpc\bX\n:\ufffd* rm\ufffd\u0011\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc03eb7eb231fee24f4d6ece9baf61804657b295",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\ufffd\ufffdI;\r\ufffd\ufffd\u0012b\ufffd\ufffd@I\ufffd\t\ufffdR2\u0000\ufffd]\u001b\ufffdpc\bX\n:\ufffd* rm\ufffd\u0011\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd[\ufffd\ufffdI;\r\ufffd\ufffdb\ufffd\ufffd@I\ufffd\t\ufffdR2\ufffd]\ufffdpcX\n:\ufffd* rm\ufffd\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[\ufffd\ufffdI;\r\ufffd\ufffd\u0012b\ufffd\ufffd@I\ufffd\t\ufffdR2\u0000\ufffd]\u001b\ufffdpc\bX\n:\ufffd* rm\ufffd\u0011\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd[\ufffd\ufffdI;\r\ufffd\ufffdb\ufffd\ufffd@I\ufffd\t\ufffdR2\ufffd]\ufffdpcX\n:\ufffd* rm\ufffd\ufffdl\ufffd,c\ufffd\ufffd]J\ufffdx\ufffd\ufffd\ufffd\ufffdM\\:.2\ufffd;S\ufffdf*$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 1.3,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"tls_clienthello",
"websphere_probe"
]
}
|
|
|
TCP |
18443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18443
Chemin / cible
—
Service
TLS
Payload
��L\< ȉ�8#� O}���Hg��u�?�Ш ���V~��=g��;@���Ȥ���b�fZVEV�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��L\< ȉ�8#�
O}���Hg��u�?�Ш ���V~��=g��;@���Ȥ���b�fZVEV�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��L\< ȉ�8#� O}���Hg��u�?�Ш ���V~��=g��;@���Ȥ���b�fZVEV�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ��KK��u\y2���
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.800547541053654,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 18443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "909c274bfe9375fd7e292dadf97aad55344692c1",
"event_fingerprint": "dac14e54a58bb8d67525ceaeefc1c6b1941b497b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "78da2881afcce48620e6c13366151d07",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 18443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL\\<\f\u0209\ufffd8#\ufffd\u0018\rO}\u0010\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\u0012\u0002\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\u0014\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\u001b\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL\\<\f\u0209\ufffd8#\ufffd\u0018\rO}\u0010\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\u0012\u0002\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\u0014\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\u001b\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdKK\ufffd\ufffd\bu\\y2\ufffd\ufffd\u0014\ufffd\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL\\<\f\u0209\ufffd8#\ufffd\u0018\rO}\u0010\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\u0012\u0002\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\u0014\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\u001b\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b506b6594fe8d8b47847c0570d0d2f4bd666995",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL\\<\f\u0209\ufffd8#\ufffd\u0018\rO}\u0010\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\u0012\u0002\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\u0014\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\u001b\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 18443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdL\\<\u0209\ufffd8#\ufffd\rO}\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:18443 \u00b7 (reconnaissance)",
"target_port_label": "18443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL\\<\f\u0209\ufffd8#\ufffd\u0018\rO}\u0010\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\u0012\u0002\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\u0014\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\u001b\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 18443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdL\\<\u0209\ufffd8#\ufffd\rO}\ufffd\ufffd\ufffdHg\ufffd\ufffdu\ufffd?\ufffd\u0428 \ufffd\ufffd\ufffdV~\ufffd\ufffd=g\ufffd\ufffd;@\ufffd\ufffd\ufffd\u0224\ufffd\ufffd\ufffdb\ufffdfZVEV\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "18443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.72,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
�� �ϗ�I68��Щ�%��Qr���ƙ��� �<f{�� ��b�^��C�"�<�����D�Hc $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��
�ϗ�I68��Щ�%��Qr���ƙ���
�<f{�� ��b�^��C�"�<�����D�Hc $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�� �ϗ�I68��Щ�%��Qr���ƙ��� �<f{�� ��b�^��C�"�<�����D�Hc $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ � ����p(;���R�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.833588271655627,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "82e7005f91727a126e0d4c319fff2fcb94ce35d5",
"event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70937101cac7642877a706f90906b634",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0005\ufffd\n\ufffd\u03d7\ufffdI6\u00148\u0001\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\u0006\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\u000e\u0002\ufffd\ufffd\u0019\ufffd\ufffdD\ufffdHc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0005\ufffd\n\ufffd\u03d7\ufffdI6\u00148\u0001\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\u0006\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\u000e\u0002\ufffd\ufffd\u0019\ufffd\ufffdD\ufffdHc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd \ufffd\u0093\ufffd\ufffd\ufffdp(;\ufffd\ufffd\ufffdR\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0005\ufffd\n\ufffd\u03d7\ufffdI6\u00148\u0001\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\u0006\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\u000e\u0002\ufffd\ufffd\u0019\ufffd\ufffdD\ufffdHc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1592febb0deff5b62b03668524bbe126ac202f23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0005\ufffd\n\ufffd\u03d7\ufffdI6\u00148\u0001\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\u0006\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\u000e\u0002\ufffd\ufffd\u0019\ufffd\ufffdD\ufffdHc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\n\ufffd\u03d7\ufffdI68\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdHc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0005\ufffd\n\ufffd\u03d7\ufffdI6\u00148\u0001\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\u0006\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\u000e\u0002\ufffd\ufffd\u0019\ufffd\ufffdD\ufffdHc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\n\ufffd\u03d7\ufffdI68\ufffd\ufffd\u0429\ufffd%\ufffd\ufffdQr\ufffd\ufffd\ufffd\u0199\ufffd\ufffd\ufffd\r \ufffd<f{\ufffd\ufffd \ufffd\ufffdb\ufffd^\ufffd\ufffdC\ufffd\"\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdHc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 2.14,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
4434 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4434 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4434
Chemin / cible
—
Service
TLS
Payload
��%5��ƽ�5��|��B��Z= ��(���:a ���U@�X�d �ΓǓ�^P� ��q�,ߩ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +19
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��%5��ƽ�5��|��B��Z=
��(���:a ���U@�X�d �ΓǓ�^P� ��q�,ߩ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��%5��ƽ�5��|��B��Z= ��(���:a ���U@�X�d �ΓǓ�^P� ��q�,ߩ $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �_���5V��!���,`
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.799141407115325,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 4434,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6c4dc081faa646f4b2516344a97a5a8084aaf025",
"event_fingerprint": "a68cb7b3ec78594cbd0f1eabfea3a055126e6ab3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "9087848156d79551ab40677174abe9f5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4434,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%5\ufffd\ufffd\u01bd\u0003\ufffd5\ufffd\ufffd|\ufffd\ufffdB\u0016\ufffd\ufffdZ=\r\ufffd\ufffd\u0017(\ufffd\ufffd\ufffd:a \ufffd\u0019\u0015\ufffd\u0014\ufffdU@\ufffdX\ufffdd\u000b\ufffd\u0393\u01d3\ufffd\u0017^P\ufffd\u001e\ufffd\ufffd\u0018q\ufffd,\u07e9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%5\ufffd\ufffd\u01bd\u0003\ufffd5\ufffd\ufffd|\ufffd\ufffdB\u0016\ufffd\ufffdZ=\r\ufffd\ufffd\u0017(\ufffd\ufffd\ufffd:a \ufffd\u0019\u0015\ufffd\u0014\ufffdU@\ufffdX\ufffdd\u000b\ufffd\u0393\u01d3\ufffd\u0017^P\ufffd\u001e\ufffd\ufffd\u0018q\ufffd,\u07e9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0015\ufffd_\ufffd\ufffd\ufffd5V\ufffd\ufffd!\ufffd\ufffd\ufffd,`",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%5\ufffd\ufffd\u01bd\u0003\ufffd5\ufffd\ufffd|\ufffd\ufffdB\u0016\ufffd\ufffdZ=\r\ufffd\ufffd\u0017(\ufffd\ufffd\ufffd:a \ufffd\u0019\u0015\ufffd\u0014\ufffdU@\ufffdX\ufffdd\u000b\ufffd\u0393\u01d3\ufffd\u0017^P\ufffd\u001e\ufffd\ufffd\u0018q\ufffd,\u07e9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec66f4d33e5edb81f540d31c97017cb52b7c3d5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%5\ufffd\ufffd\u01bd\u0003\ufffd5\ufffd\ufffd|\ufffd\ufffdB\u0016\ufffd\ufffdZ=\r\ufffd\ufffd\u0017(\ufffd\ufffd\ufffd:a \ufffd\u0019\u0015\ufffd\u0014\ufffdU@\ufffdX\ufffdd\u000b\ufffd\u0393\u01d3\ufffd\u0017^P\ufffd\u001e\ufffd\ufffd\u0018q\ufffd,\u07e9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 4434,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd%5\ufffd\ufffd\u01bd\ufffd5\ufffd\ufffd|\ufffd\ufffdB\ufffd\ufffdZ=\r\ufffd\ufffd(\ufffd\ufffd\ufffd:a \ufffd\ufffd\ufffdU@\ufffdX\ufffdd\ufffd\u0393\u01d3\ufffd^P\ufffd\ufffd\ufffdq\ufffd,\u07e9$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4434 \u00b7 (reconnaissance)",
"target_port_label": "4434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 19
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4434,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +19",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd%5\ufffd\ufffd\u01bd\u0003\ufffd5\ufffd\ufffd|\ufffd\ufffdB\u0016\ufffd\ufffdZ=\r\ufffd\ufffd\u0017(\ufffd\ufffd\ufffd:a \ufffd\u0019\u0015\ufffd\u0014\ufffdU@\ufffdX\ufffdd\u000b\ufffd\u0393\u01d3\ufffd\u0017^P\ufffd\u001e\ufffd\ufffd\u0018q\ufffd,\u07e9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 4434,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4434 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd%5\ufffd\ufffd\u01bd\ufffd5\ufffd\ufffd|\ufffd\ufffdB\ufffd\ufffdZ=\r\ufffd\ufffd(\ufffd\ufffd\ufffd:a \ufffd\ufffd\ufffdU@\ufffdX\ufffdd\ufffd\u0393\u01d3\ufffd^P\ufffd\ufffd\ufffdq\ufffd,\u07e9$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 19,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4444 · I2P
|
i2p
|
Scan de ports
port scan syn · via I2P:4444 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
I2P
WAF
—
Recommandation
Surveiller
Tags
i2p_emulated
i2p_payload
net_i2p_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4444
Chemin / cible
—
Service
I2P
Payload
��n��0�Mb����7�T�K� OE������ 1�#��d]�v}���y���W�LR��S���f%% $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��n��0�Mb����7�T�K� OE������ 1�#��d]�v}���y���W�LR��S���f%% $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��n��0�Mb����7�T�K� OE������ 1�#��d]�v}���y���W�LR��S���f%% $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ <.P��G��!�s$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000010000000000000000000000000",
"emulator_response_len": 16,
"bytes_in": 517,
"payload_entropy": 3.817117344539073,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "i2p",
"app_proto": "i2p",
"asn": 215540,
"country": "IQ",
"dst_port": 4444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "304f3ffd9d07028a5a9bd31bde61a37c016e139a",
"event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "i2p",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70d25faea3f931bd019838d48085a0a7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4444,
"service": "i2p",
"service_name": "i2p",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd0\ufffd\u0016Mb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffd\u0000OE\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd0\ufffd\u0016Mb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffd\u0000OE\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 <.P\ufffd\u0007\ufffdG\ufffd\ufffd!\u0006\ufffd\u0018s$",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd0\ufffd\u0016Mb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffd\u0000OE\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "283968966df735b8c313c6980a1a52b66d0eceef",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd0\ufffd\u0016Mb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffd\u0000OE\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd0\ufffdMb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffdOE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via I2P \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "i2p",
"service_label_fr": "I2P",
"dst_port": 4444,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-i2p",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd0\ufffd\u0016Mb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffd\u0000OE\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd0\ufffdMb\ufffd\ufffd\ufffd\ufffd\uf5717\ufffdT\ufffdK\ufffdOE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd 1\ufffd#\ufffd\ufffdd]\ufffdv}\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdW\ufffdLR\ufffd\ufffdS\ufffd\ufffd\ufffdf%%$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "i2p",
"service_banner": "honeypot-i2p",
"service_os": "linux",
"dst_port": "4444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
8443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 60,
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"i2p_emulated",
"i2p_payload",
"net_i2p_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
15443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15443
Chemin / cible
—
Service
TLS
Payload
�#v(l�wD�h�\ %�o O�>η��/܌�^3�n( �*�� C��V'V CXH��[&���0U� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�#v(l�wD�h�\ %�o O�>η��/܌�^3�n( �*�� C��V'V CXH��[&���0U� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�#v(l�wD�h�\ %�o O�>η��/܌�^3�n( �*�� C��V'V CXH��[&���0U� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ v�H�#l�k�4lIO��
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.7517449555697837,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 15443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3613861a624e81645fe61a4427441d0b5ad2dc3f",
"event_fingerprint": "e2f517e0d18073285cb71dc6584f40290c8f52f4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "b0ed16a09d665f83864ab2fc6a35b11d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003#v(l\ufffdwD\ufffdh\ufffd\\\u0000%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\u0016\ufffd\ufffd C\ufffd\ufffdV'V\u001c\u001cC\u0017XH\ufffd\u001a\ufffd[&\ufffd\ufffd\u0012\ufffd0U\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003#v(l\ufffdwD\ufffdh\ufffd\\\u0000%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\u0016\ufffd\ufffd C\ufffd\ufffdV'V\u001c\u001cC\u0017XH\ufffd\u001a\ufffd[&\ufffd\ufffd\u0012\ufffd0U\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 v\ufffdH\ufffd\u0006#l\ufffdk\ufffd4lIO\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003#v(l\ufffdwD\ufffdh\ufffd\\\u0000%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\u0016\ufffd\ufffd C\ufffd\ufffdV'V\u001c\u001cC\u0017XH\ufffd\u001a\ufffd[&\ufffd\ufffd\u0012\ufffd0U\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44be46bd73479f70a5045447a993b3c5b7b600b6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003#v(l\ufffdwD\ufffdh\ufffd\\\u0000%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\u0016\ufffd\ufffd C\ufffd\ufffdV'V\u001c\u001cC\u0017XH\ufffd\u001a\ufffd[&\ufffd\ufffd\u0012\ufffd0U\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 15443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd#v(l\ufffdwD\ufffdh\ufffd\\%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\ufffd\ufffd C\ufffd\ufffdV'VCXH\ufffd\ufffd[&\ufffd\ufffd\ufffd0U\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15443 \u00b7 (reconnaissance)",
"target_port_label": "15443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003#v(l\ufffdwD\ufffdh\ufffd\\\u0000%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\u0016\ufffd\ufffd C\ufffd\ufffdV'V\u001c\u001cC\u0017XH\ufffd\u001a\ufffd[&\ufffd\ufffd\u0012\ufffd0U\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 15443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd#v(l\ufffdwD\ufffdh\ufffd\\%\ufffdo O\ufffd>\u03b7\ufffd\ufffd\/\u070c\ufffd^3\ufffdn( \ufffd*\ufffd\ufffd C\ufffd\ufffdV'VCXH\ufffd\ufffd[&\ufffd\ufffd\ufffd0U\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "15443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
8443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 70,
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Scan de ports
port scan syn · via K8S API:6443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
� Q ��-C�� ϕf�E'�IF��ٛ�*�j� �aM���$�t��N��=�rP" �/ۗ �6�T�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� Q ��-C�� ϕf�E'�IF��ٛ�*�j� �aM���$�t��N��=�rP" �/ۗ �6�T�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
� Q ��-C�� ϕf�E'�IF��ٛ�*�j� �aM���$�t��N��=�rP" �/ۗ �6�T�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ������^����o
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 517,
"payload_entropy": 3.7822073887358987,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 215540,
"country": "IQ",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c5680e432ceae97de85adc33b7cab23b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\u0011Q \u0007\ufffd\ufffd\u0019-C\ufffd\ufffd\u001e\u03d5f\ufffd\u0016E'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\u0007\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\u001e\ufffd\/\u06d7\u000b\ufffd6\ufffdT\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\u0011Q \u0007\ufffd\ufffd\u0019-C\ufffd\ufffd\u001e\u03d5f\ufffd\u0016E'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\u0007\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\u001e\ufffd\/\u06d7\u000b\ufffd6\ufffdT\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001e\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\u000eo\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\u0011Q \u0007\ufffd\ufffd\u0019-C\ufffd\ufffd\u001e\u03d5f\ufffd\u0016E'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\u0007\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\u001e\ufffd\/\u06d7\u000b\ufffd6\ufffdT\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "540cd305a1588ffb790272ea4093c0473d9f4324",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\u0011Q \u0007\ufffd\ufffd\u0019-C\ufffd\ufffd\u001e\u03d5f\ufffd\u0016E'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\u0007\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\u001e\ufffd\/\u06d7\u000b\ufffd6\ufffdT\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "\ufffdQ \ufffd\ufffd-C\ufffd\ufffd\u03d5f\ufffdE'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\ufffd\/\u06d7\ufffd6\ufffdT\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via K8S API \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\u0011Q \u0007\ufffd\ufffd\u0019-C\ufffd\ufffd\u001e\u03d5f\ufffd\u0016E'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\u0007\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\u001e\ufffd\/\u06d7\u000b\ufffd6\ufffdT\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdQ \ufffd\ufffd-C\ufffd\ufffd\u03d5f\ufffdE'\ufffdIF\ufffd\ufffd\u065b\ufffd*\ufffdj\ufffd \ufffdaM\ufffd\ufffd\ufffd$\ufffdt\ufffd\ufffdN\ufffd\ufffd=\ufffdrP\"\ufffd\/\u06d7\ufffd6\ufffdT\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
6443,
8443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 80,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
10443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:10443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10443
Chemin / cible
—
Service
HTTPS
Payload
�����U�3�՞T} �C�,<��\+<��,C� Y;Hz�v͘,#��8/E�>2���^ �g���v�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�����U�3�՞T}
�C�,<��\+<��,C� Y;Hz�v͘,#��8/E�>2���^
�g���v�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�����U�3�՞T} �C�,<��\+<��,C� Y;Hz�v͘,#��8/E�>2���^ �g���v�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ n\��e(%��5S7��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.7842104108628933,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 10443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bf82ed4958219b6801f74213ab3f101ded76679b",
"event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "488381b1ca7273bac1c61e1125c8ef10",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffd\u0011C\ufffd,\u0004<\ufffd\ufffd\\+<\ufffd\u0014\ufffd\u0019,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\u0016\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffd\u0011C\ufffd,\u0004<\ufffd\ufffd\\+<\ufffd\u0014\ufffd\u0019,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\u0016\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010n\\\ufffd\ufffde(%\ufffd\ufffd5S7\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffd\u0011C\ufffd,\u0004<\ufffd\ufffd\\+<\ufffd\u0014\ufffd\u0019,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\u0016\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f5bc073d0ba9d28089924753a31530b4d61d599",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffd\u0011C\ufffd,\u0004<\ufffd\ufffd\\+<\ufffd\u0014\ufffd\u0019,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\u0016\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffdC\ufffd,<\ufffd\ufffd\\+<\ufffd\ufffd,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 10443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffd\u0011C\ufffd,\u0004<\ufffd\ufffd\\+<\ufffd\u0014\ufffd\u0019,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\u0016\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd3\ufffd\u055eT}\r\ufffdC\ufffd,<\ufffd\ufffd\\+<\ufffd\ufffd,C\ufffd Y;Hz\ufffdv\u0358,#\ufffd\ufffd8\/E\ufffd>2\ufffd\ufffd\ufffd^\n\ufffdg\ufffd\ufffd\ufffdv\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "10443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
6443,
8443,
10443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 90,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
��"f7Q g�Y} ���x jо&Uy:� B�?�� %=���+� �]��a��t�1����G��i� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
��"f7Q g�Y} ���x jо&Uy:� B�?�� %=���+� �]��a��t�1����G��i� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��"f7Q g�Y} ���x jо&Uy:� B�?�� %=���+� �]��a��t�1����G��i� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ���X�:�i��=J�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.7765350675241347,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70e238f893d11e91a76225e2b39f9072",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\"f7Q\u001dg\ufffdY}\u001d\ufffd\ufffd\ufffdx\tj\u043e&U\u001ay:\ufffd\u001eB\ufffd\u0011?\ufffd\ufffd %\u001a=\ufffd\u0003\ufffd\ufffd+\ufffd \u001a\ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffd\u0001G\ufffd\u000f\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\"f7Q\u001dg\ufffdY}\u001d\ufffd\ufffd\ufffdx\tj\u043e&U\u001ay:\ufffd\u001eB\ufffd\u0011?\ufffd\ufffd %\u001a=\ufffd\u0003\ufffd\ufffd+\ufffd \u001a\ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffd\u0001G\ufffd\u000f\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001e\u0011\u001f\ufffd\ufffd\ufffdX\ufffd:\ufffdi\ufffd\ufffd=J\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\"f7Q\u001dg\ufffdY}\u001d\ufffd\ufffd\ufffdx\tj\u043e&U\u001ay:\ufffd\u001eB\ufffd\u0011?\ufffd\ufffd %\u001a=\ufffd\u0003\ufffd\ufffd+\ufffd \u001a\ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffd\u0001G\ufffd\u000f\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ddb367cb6fc9bc2f2eea575f5234d84b81a44da",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\"f7Q\u001dg\ufffdY}\u001d\ufffd\ufffd\ufffdx\tj\u043e&U\u001ay:\ufffd\u001eB\ufffd\u0011?\ufffd\ufffd %\u001a=\ufffd\u0003\ufffd\ufffd+\ufffd \u001a\ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffd\u0001G\ufffd\u000f\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\"f7Qg\ufffdY}\ufffd\ufffd\ufffdx\tj\u043e&Uy:\ufffdB\ufffd?\ufffd\ufffd %=\ufffd\ufffd\ufffd+\ufffd \ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\"f7Q\u001dg\ufffdY}\u001d\ufffd\ufffd\ufffdx\tj\u043e&U\u001ay:\ufffd\u001eB\ufffd\u0011?\ufffd\ufffd %\u001a=\ufffd\u0003\ufffd\ufffd+\ufffd \u001a\ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffd\u0001G\ufffd\u000f\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\"f7Qg\ufffdY}\ufffd\ufffd\ufffdx\tj\u043e&Uy:\ufffdB\ufffd?\ufffd\ufffd %=\ufffd\ufffd\ufffd+\ufffd \ufffd]\ufffd\ufffda\ufffd\ufffdt\ufffd1\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
6443,
8443,
9443,
10443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 100,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
Scan de ports
port scan syn · via ORACLE EM:7443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_em_emulated
oracle_em_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Service
ORACLE EM
Payload
�d�C@y�#k��^t�Q������`�4-3$�n� 0�S";<y/��x��8��gC��|��� �2�9�*� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�d�C@y�#k��^t�Q������`�4-3$�n� 0�S";<y/��x��8��gC��|��� �2�9�*� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�d�C@y�#k��^t�Q������`�4-3$�n� 0�S";<y/��x��8��gC��|��� �2�9�*� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ���G�"�}UCЧ�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.743943699957437,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "oracle-em",
"app_proto": "oracle-em",
"asn": 215540,
"country": "IQ",
"dst_port": 7443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b",
"event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "oracle-em",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bda4260b53d1226e6b3aa3ae9ba86b9c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7443,
"service": "oracle-em",
"service_name": "oracle-em",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d\ufffdC@y\ufffd\u001a\u0012#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\u0017\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\u0000\ufffd2\ufffd9\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d\ufffdC@y\ufffd\u001a\u0012#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\u0017\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\u0000\ufffd2\ufffd9\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0001\u0005\ufffdG\ufffd\"\ufffd\u0015}UC\u0427\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d\ufffdC@y\ufffd\u001a\u0012#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\u0017\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\u0000\ufffd2\ufffd9\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41c1f7bcda7ca979a89d0542e87b94cdadb6aced",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d\ufffdC@y\ufffd\u001a\u0012#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\u0017\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\u0000\ufffd2\ufffd9\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"evidence_snippet": "\ufffdd\ufffdC@y\ufffd#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd2\ufffd9\ufffd*\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ORACLE EM \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "oracle-em",
"service_label_fr": "ORACLE EM",
"dst_port": 7443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle-em",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d\ufffdC@y\ufffd\u001a\u0012#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\u0017\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\u0000\ufffd2\ufffd9\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdd\ufffdC@y\ufffd#k\ufffd\ufffd^t\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd4-3$\ufffdn\ufffd 0\ufffdS\";<y\/\ufffd\ufffdx\ufffd\ufffd8\ufffd\ufffdgC\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd2\ufffd9\ufffd*\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle_em",
"service_banner": "honeypot-oracle-em",
"service_os": "linux",
"dst_port": "7443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 100.66,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_oracle_tns_probe",
"oracle_em_emulated",
"oracle_em_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
444 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:444 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
444
Chemin / cible
—
Service
TLS
Payload
�l�(- ��o��O�֍�r ,!W�3� �@d)P C� ��G�Jʻ�:���oD ��<�����' $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�l�(- ��o��O�֍�r ,!W�3� �@d)P C�
��G�Jʻ�:���oD
��<�����' $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�l�(- ��o��O�֍�r ,!W�3� �@d)P C� ��G�Jʻ�:���oD ��<�����' $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ D���s� ᭫��o
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.8110209224926477,
"port_category": "well_known",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "41057255eba7736def6bb8d6ef699be80410b4b0",
"event_fingerprint": "335b4162c6e5b26a8994d7a4acee62e78ae3ddf5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "bfeee0a5e581a4bd2832cc660782caac",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 444,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\ufffd(\u0007-\u001e\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr\u000b,!W\ufffd\u00063\ufffd\u001d\ufffd@d)P\u0002 C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\u0003\ufffd\ufffdoD\u000e\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\ufffd(\u0007-\u001e\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr\u000b,!W\ufffd\u00063\ufffd\u001d\ufffd@d)P\u0002 C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\u0003\ufffd\ufffdoD\u000e\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 D\ufffd\ufffd\ufffds\ufffd\r\u1b6b\u0014\u000f\ufffd\ufffdo",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\ufffd(\u0007-\u001e\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr\u000b,!W\ufffd\u00063\ufffd\u001d\ufffd@d)P\u0002 C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\u0003\ufffd\ufffdoD\u000e\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dca92c31a9420dbb32b93f7a7c2b15802029e74e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\ufffd(\u0007-\u001e\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr\u000b,!W\ufffd\u00063\ufffd\u001d\ufffd@d)P\u0002 C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\u0003\ufffd\ufffdoD\u000e\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 444,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdl\ufffd(-\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr,!W\ufffd3\ufffd\ufffd@d)P C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\ufffd\ufffdoD\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:444 \u00b7 (reconnaissance)",
"target_port_label": "444 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 444,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\ufffd(\u0007-\u001e\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr\u000b,!W\ufffd\u00063\ufffd\u001d\ufffd@d)P\u0002 C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\u0003\ufffd\ufffdoD\u000e\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 444,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:444 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdl\ufffd(-\ufffd\ufffdo\ufffd\ufffdO\ufffd\u058d\ufffdr,!W\ufffd3\ufffd\ufffd@d)P C\ufffd\n\ufffd\ufffdG\ufffdJ\u02bb\ufffd:\ufffd\ufffd\ufffdoD\r\ufffd\ufffd<\uf2ff\ufffd\ufffd\ufffd\ufffd\ufffd'$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "444 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 103.72,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
11443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:11443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11443
Chemin / cible
—
Service
TLS
Payload
�SCM h�Q �5 �d� |J ^)f�\��� �zI( \��:�γl��-���rFK6���~~ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�SCM h�Q �5
�d�
|J
^)f�\��� �zI( \��:�γl��-���rFK6���~~ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�SCM h�Q �5 �d� |J ^)f�\��� �zI( \��:�γl��-���rFK6���~~ $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ��/$KZZ"8����v�
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.7837736654763616,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 11443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "530ce4def25c0deaa3196bb06ca3b950db4d81ee",
"event_fingerprint": "05624ac88458486f06c30e699076b303937e56c7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "23d0a4fd5ee5d7e615fb2c78e9e22f9d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 11443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003SCM h\ufffdQ\t\ufffd5\b\n\u0017\ufffdd\ufffd\n\u0007|J\n\u000f^\u0001)f\u0011\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\u001d\\\ufffd\u001a\ufffd:\u0012\ufffd\u03b3\u0002l\u0011\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003SCM h\ufffdQ\t\ufffd5\b\n\u0017\ufffdd\ufffd\n\u0007|J\n\u000f^\u0001)f\u0011\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\u001d\\\ufffd\u001a\ufffd:\u0012\ufffd\u03b3\u0002l\u0011\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\/$KZZ\u0017\"8\ufffd\ufffd\ufffd\ufffdv\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003SCM h\ufffdQ\t\ufffd5\b\n\u0017\ufffdd\ufffd\n\u0007|J\n\u000f^\u0001)f\u0011\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\u001d\\\ufffd\u001a\ufffd:\u0012\ufffd\u03b3\u0002l\u0011\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15193b9331dc8ed8e5db2bd1a9ebf5ef36f3fc86",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003SCM h\ufffdQ\t\ufffd5\b\n\u0017\ufffdd\ufffd\n\u0007|J\n\u000f^\u0001)f\u0011\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\u001d\\\ufffd\u001a\ufffd:\u0012\ufffd\u03b3\u0002l\u0011\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 11443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdSCM h\ufffdQ\t\ufffd5\n\ufffdd\ufffd\n|J\n^)f\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\\\ufffd\ufffd:\ufffd\u03b3l\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:11443 \u00b7 (reconnaissance)",
"target_port_label": "11443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 11443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003SCM h\ufffdQ\t\ufffd5\b\n\u0017\ufffdd\ufffd\n\u0007|J\n\u000f^\u0001)f\u0011\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\u001d\\\ufffd\u001a\ufffd:\u0012\ufffd\u03b3\u0002l\u0011\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 11443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:11443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdSCM h\ufffdQ\t\ufffd5\n\ufffdd\ufffd\n|J\n^)f\ufffd\\\ufffd\ufffd\ufffd \ufffdzI(\\\ufffd\ufffd:\ufffd\u03b3l\ufffd\ufffd-\ufffd\ufffd\ufffdrFK6\ufffd\ufffd\ufffd~~$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "11443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "11443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 22.22,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
�~�ֶ�ϛ����i����h��ӣQ �.� ���/.838N��TU�Mf,)�$��xj Uf� � $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�~�ֶ�ϛ����i����h��ӣQ �.� ���/.838N��TU�Mf,)�$��xj Uf� � $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�~�ֶ�ϛ����i����h��ӣQ �.� ���/.838N��TU�Mf,)�$��xj Uf� � $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ !Ð�'VtG�Bu���a�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.7969761934233244,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "pharos",
"app_proto": "pharos",
"asn": 215540,
"country": "IQ",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ebdcb0bd9e108f0719c8626af4cb167",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003~\ufffd\u05b6\ufffd\u03db\u0011\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u0005\u0016\ufffd\u0010\u0012\ufffdh\ufffd\ufffd\u04e3Q\u001e\ufffd\u0019.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,\u0014)\ufffd$\ufffd\ufffdx\u0017j\fUf\ufffd \ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003~\ufffd\u05b6\ufffd\u03db\u0011\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u0005\u0016\ufffd\u0010\u0012\ufffdh\ufffd\ufffd\u04e3Q\u001e\ufffd\u0019.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,\u0014)\ufffd$\ufffd\ufffdx\u0017j\fUf\ufffd \ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 !\u00d0\ufffd'VtG\ufffdBu\ufffd\ufffd\ufffda\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003~\ufffd\u05b6\ufffd\u03db\u0011\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u0005\u0016\ufffd\u0010\u0012\ufffdh\ufffd\ufffd\u04e3Q\u001e\ufffd\u0019.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,\u0014)\ufffd$\ufffd\ufffdx\u0017j\fUf\ufffd \ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab04fd9c40f02ae76c2aa06594d3c40d4867b5ad",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003~\ufffd\u05b6\ufffd\u03db\u0011\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u0005\u0016\ufffd\u0010\u0012\ufffdh\ufffd\ufffd\u04e3Q\u001e\ufffd\u0019.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,\u0014)\ufffd$\ufffd\ufffdx\u0017j\fUf\ufffd \ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd~\ufffd\u05b6\ufffd\u03db\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\u04e3Q\ufffd.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,)\ufffd$\ufffd\ufffdxjUf\ufffd \ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003~\ufffd\u05b6\ufffd\u03db\u0011\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u0005\u0016\ufffd\u0010\u0012\ufffdh\ufffd\ufffd\u04e3Q\u001e\ufffd\u0019.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,\u0014)\ufffd$\ufffd\ufffdx\u0017j\fUf\ufffd \ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd~\ufffd\u05b6\ufffd\u03db\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\u04e3Q\ufffd.\ufffd \ufffd\ufffd\ufffd\/.838N\ufffd\ufffdTU\ufffdMf,)\ufffd$\ufffd\ufffdxjUf\ufffd \ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
4433 · QUIC HTTP3 STUB
|
quic-http3-stub
|
quic probe
quic probe · via QUIC HTTP3 STUB:4433 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
QUIC-HTTP3-STUB
WAF
—
Recommandation
Surveiller
Tags
net_quic_probe
quic_http3_stub_emulated
quic_http3_stub_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4433
Chemin / cible
—
Service
QUIC HTTP3 STUB
Payload
��_�!b_4Dt ]k|�����>�8� � ��� �M�O�f�r0'�1�g}l�u& �d� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « quic_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��_�!b_4Dt ]k|�����>�8� � ��� �M�O�f�r0'�1�g}l�u& �d� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��_�!b_4Dt ]k|�����>�8� � ��� �M�O�f�r0'�1�g}l�u& �d� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ 0� F�#�;v �K��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0c00000000485454502f3320686f6e6579706f7420737475620d0a",
"emulator_response_len": 27,
"bytes_in": 517,
"payload_entropy": 3.7492753852661247,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "quic-http3-stub",
"app_proto": "quic-http3-stub",
"asn": 215540,
"country": "IQ",
"dst_port": 4433,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a8bd063f644b84e1de1a05db0b9f17e832ed6e2d",
"event_fingerprint": "69ec763c111675fc5207ef508e4abdef0f3279d4",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"service_name": "quic-http3-stub",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "69ea2036758c3efc353d787188a18fe9",
"path_pattern_hash": "9e995d52485cdb3f5eaf00457847ee42"
},
"target_context": {
"dst_port": 4433,
"service": "quic-http3-stub",
"service_name": "quic-http3-stub",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0007\u0005_\ufffd!b_4Dt\u0000]k|\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>\u0007\ufffd8\u0001\ufffd\u001e\ufffd\u0019 \ufffd\ufffd\ufffd\u0000\u0013\ufffdM\ufffdO\ufffdf\ufffdr0\u0002'\ufffd1\ufffdg}l\u0010\ufffdu&\u000b\ufffdd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0007\u0005_\ufffd!b_4Dt\u0000]k|\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>\u0007\ufffd8\u0001\ufffd\u001e\ufffd\u0019 \ufffd\ufffd\ufffd\u0000\u0013\ufffdM\ufffdO\ufffdf\ufffdr0\u0002'\ufffd1\ufffdg}l\u0010\ufffdu&\u000b\ufffdd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 0\ufffd\u001dF\ufffd#\u0012\ufffd;v\u001d\ufffdK\ufffd\u0012\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0007\u0005_\ufffd!b_4Dt\u0000]k|\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>\u0007\ufffd8\u0001\ufffd\u001e\ufffd\u0019 \ufffd\ufffd\ufffd\u0000\u0013\ufffdM\ufffdO\ufffdf\ufffdr0\u0002'\ufffd1\ufffdg}l\u0010\ufffdu&\u000b\ufffdd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b337bdb3d257e5207a9d1e9323990c98ac0ee2f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0007\u0005_\ufffd!b_4Dt\u0000]k|\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>\u0007\ufffd8\u0001\ufffd\u001e\ufffd\u0019 \ufffd\ufffd\ufffd\u0000\u0013\ufffdM\ufffdO\ufffdf\ufffdr0\u0002'\ufffd1\ufffdg}l\u0010\ufffdu&\u000b\ufffdd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"evidence_snippet": "\ufffd\ufffd_\ufffd!b_4Dt]k|\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdM\ufffdO\ufffdf\ufffdr0'\ufffd1\ufffdg}l\ufffdu&\ufffdd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)",
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB",
"dst_port": 4433,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-quic-http3-stub",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0007\u0005_\ufffd!b_4Dt\u0000]k|\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>\u0007\ufffd8\u0001\ufffd\u001e\ufffd\u0019 \ufffd\ufffd\ufffd\u0000\u0013\ufffdM\ufffdO\ufffdf\ufffdr0\u0002'\ufffd1\ufffdg}l\u0010\ufffdu&\u000b\ufffdd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd_\ufffd!b_4Dt]k|\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdM\ufffdO\ufffdf\ufffdr0'\ufffd1\ufffdg}l\ufffdu&\ufffdd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "quic_http3_stub",
"service_banner": "honeypot-quic-http3-stub",
"service_os": "linux",
"dst_port": "4433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_quic_probe",
"quic_http3_stub_emulated",
"quic_http3_stub_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
�H��y�7; <�C��jM�<H��&(�����ѓ ���{2��!1[��{�8Q�:`���_�N�Z�| $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +12
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�H��y�7;
<�C��jM�<H��&(�����ѓ ���{2��!1[��{�8Q�:`���_�N�Z�| $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�H��y�7; <�C��jM�<H��&(�����ѓ ���{2��!1[��{�8Q�:`���_�N�Z�| $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ 3������,ީZ�%
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.806666195146138,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 12
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f30602bdb9268b9b745b5973390f680c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffdy\ufffd7;\n<\ufffdC\u0003\ufffd\ufffdjM\ufffd<H\ufffd\u0017\ufffd&\u0019(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\u0004\ufffd\ufffd!1[\ufffd\ufffd\u001b{\ufffd8Q\ufffd\u0016:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffdy\ufffd7;\n<\ufffdC\u0003\ufffd\ufffdjM\ufffd<H\ufffd\u0017\ufffd&\u0019(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\u0004\ufffd\ufffd!1[\ufffd\ufffd\u001b{\ufffd8Q\ufffd\u0016:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 3\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffd,\u07a9Z\ufffd\u0381%",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffdy\ufffd7;\n<\ufffdC\u0003\ufffd\ufffdjM\ufffd<H\ufffd\u0017\ufffd&\u0019(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\u0004\ufffd\ufffd!1[\ufffd\ufffd\u001b{\ufffd8Q\ufffd\u0016:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d413ac33752cf8209d671d3df337487a7c352e8a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffdy\ufffd7;\n<\ufffdC\u0003\ufffd\ufffdjM\ufffd<H\ufffd\u0017\ufffd&\u0019(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\u0004\ufffd\ufffd!1[\ufffd\ufffd\u001b{\ufffd8Q\ufffd\u0016:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffdH\ufffd\ufffdy\ufffd7;\n<\ufffdC\ufffd\ufffdjM\ufffd<H\ufffd\ufffd&(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\ufffd\ufffd!1[\ufffd\ufffd{\ufffd8Q\ufffd:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 12
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +12",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffdy\ufffd7;\n<\ufffdC\u0003\ufffd\ufffdjM\ufffd<H\ufffd\u0017\ufffd&\u0019(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\u0004\ufffd\ufffd!1[\ufffd\ufffd\u001b{\ufffd8Q\ufffd\u0016:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdH\ufffd\ufffdy\ufffd7;\n<\ufffdC\ufffd\ufffdjM\ufffd<H\ufffd\ufffd&(\ufffd\ufffd\ufffd\ufffd\ufffd\u0453 \ufffd\ufffd\ufffd{2\ufffd\ufffd!1[\ufffd\ufffd{\ufffd8Q\ufffd:`\ufffd\ufffd\ufffd_\ufffdN\ufffdZ\ufffd|$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 30,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 12,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
18443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18443
Chemin / cible
—
Service
TLS
Payload
���`e� 1k��++�{0��k�ZZ�c���b8��� bf,8�<N~�D�<�6��=/�4���^<C�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���`e�
1k��++�{0��k�ZZ�c���b8��� bf,8�<N~�D�<�6��=/�4���^<C�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
���`e� 1k��++�{0��k�ZZ�c���b8��� bf,8�<N~�D�<�6��=/�4���^<C�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ � s��_�6�e�a�Q1#
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.798031004726969,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 18443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c15bbb6907ffd92b6f18dcd4b4f9a14cf258b194",
"event_fingerprint": "4c6e25c7169a8cfb0dcbb424d53064fdbe043cb6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "610dbdfd8330371d446d24cb17a77e4c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 18443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffd\u0003D\ufffd<\ufffd6\u001a\ufffd\u0004\ufffd=\/\ufffd\u00114\ufffd\ufffd\ufffd^<C\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffd\u0003D\ufffd<\ufffd6\u001a\ufffd\u0004\ufffd=\/\ufffd\u00114\ufffd\ufffd\ufffd^<C\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001ds\ufffd\ufffd_\ufffd6\ufffde\ufffda\ufffdQ1#",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffd\u0003D\ufffd<\ufffd6\u001a\ufffd\u0004\ufffd=\/\ufffd\u00114\ufffd\ufffd\ufffd^<C\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cfb0f133cf905d865aea6d6d08faab75b836c24f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffd\u0003D\ufffd<\ufffd6\u001a\ufffd\u0004\ufffd=\/\ufffd\u00114\ufffd\ufffd\ufffd^<C\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 18443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffdD\ufffd<\ufffd6\ufffd\ufffd=\/\ufffd4\ufffd\ufffd\ufffd^<C\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:18443 \u00b7 (reconnaissance)",
"target_port_label": "18443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffd\u0003D\ufffd<\ufffd6\u001a\ufffd\u0004\ufffd=\/\ufffd\u00114\ufffd\ufffd\ufffd^<C\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 18443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd`e\ufffd\r1k\ufffd\ufffd++\ufffd{0\ufffd\ufffdk\ufffdZZ\ufffdc\ufffd\ufffd\ufffdb8\ufffd\ufffd\ufffd bf,8\ufffd<N~\ufffdD\ufffd<\ufffd6\ufffd\ufffd=\/\ufffd4\ufffd\ufffd\ufffd^<C\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "18443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
4433,
4443,
8443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 40,
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4434 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4434 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4434
Chemin / cible
—
Service
TLS
Payload
�b��.Eh# ��_�vT��Z�e< z�=�LhC� G�� �ҋ`iMG�Q�J�B�/��<}�$�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�b��.Eh# ��_�vT��Z�e< z�=�LhC� G�� �ҋ`iMG�Q�J�B�/��<}�$�� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�b��.Eh# ��_�vT��Z�e< z�=�LhC� G�� �ҋ`iMG�Q�J�B�/��<}�$�� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ �z)��3� >Jn�
Meta JSON brut
{
"tls_ja3_hash": "4b510481e2e54d5956f56d2177fb122d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 3.795963670894783,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "tls",
"app_proto": "tls",
"asn": 215540,
"country": "IQ",
"dst_port": 4434,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f4a974a0e4b09163daa63a101ca78e23d75edaca",
"event_fingerprint": "8bfc5fd10707101fe3e12f44bb181d701eda0c68",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4b510481e2e54d5956f56d2177fb122d",
"payload_hash": "f7e7062415f1cb69d06536c580ade3a2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4434,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0006\ufffd.Eh#\u001e\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<\u001dz\u0002\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\u001f\ufffd\u048b\u0011`iMG\ufffdQ\ufffd\u0017\u0003\u0006J\ufffdB\ufffd\/\ufffd\ufffd<\u0015}\ufffd$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0006\ufffd.Eh#\u001e\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<\u001dz\u0002\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\u001f\ufffd\u048b\u0011`iMG\ufffdQ\ufffd\u0017\u0003\u0006J\ufffdB\ufffd\/\ufffd\ufffd<\u0015}\ufffd$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0014z)\ufffd\u0014\ufffd3\ufffd\u0012\u001c>\u0001Jn\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0006\ufffd.Eh#\u001e\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<\u001dz\u0002\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\u001f\ufffd\u048b\u0011`iMG\ufffdQ\ufffd\u0017\u0003\u0006J\ufffdB\ufffd\/\ufffd\ufffd<\u0015}\ufffd$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76643c709cb39bb998542578afcd736e754bdf2a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0006\ufffd.Eh#\u001e\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<\u001dz\u0002\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\u001f\ufffd\u048b\u0011`iMG\ufffdQ\ufffd\u0017\u0003\u0006J\ufffdB\ufffd\/\ufffd\ufffd<\u0015}\ufffd$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 4434,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdb\ufffd\ufffd.Eh#\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<z\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\ufffd\u048b`iMG\ufffdQ\ufffdJ\ufffdB\ufffd\/\ufffd\ufffd<}\ufffd$\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4434 \u00b7 (reconnaissance)",
"target_port_label": "4434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4434,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0006\ufffd.Eh#\u001e\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<\u001dz\u0002\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\u001f\ufffd\u048b\u0011`iMG\ufffdQ\ufffd\u0017\u0003\u0006J\ufffdB\ufffd\/\ufffd\ufffd<\u0015}\ufffd$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"tls_ja3": "4b510481e2e54d5956f56d2177fb122d",
"port": 4434,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4434 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdb\ufffd\ufffd.Eh#\ufffd\ufffd_\ufffdvT\ufffd\ufffdZ\ufffde<z\ufffd=\ufffdLhC\ufffd G\ufffd\ufffd\ufffd\u048b`iMG\ufffdQ\ufffdJ\ufffdB\ufffd\/\ufffd\ufffd<}\ufffd$\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "4434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
4433,
4434,
4443,
8443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 50,
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde HTTP
Sonde HTTP · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "https",
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a290a31f54554d3db67fb9ec50e66b26c3cce82",
"protocol_details": {
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe"
]
}
|
|
|
TCP |
4433 · QUIC HTTP3 STUB
|
quic-http3-stub
|
quic probe
quic probe · via QUIC HTTP3 STUB:4433 · (sonde / probe)
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
QUIC-HTTP3-STUB
WAF
—
Recommandation
Surveiller
Tags
net_quic_probe
quic_http3_stub_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4433
Chemin / cible
—
Pourquoi cette classification : Type « quic_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 31
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0c00000000485454502f3320686f6e6579706f7420737475620d0a",
"emulator_response_len": 27,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "quic-http3-stub",
"app_proto": "quic-http3-stub",
"asn": 215540,
"country": "IQ",
"dst_port": 4433,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 31,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4f95dde96547e9cdf24a133ec763ba2016c776e3",
"event_fingerprint": "69ec763c111675fc5207ef508e4abdef0f3279d4",
"classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 31,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "quic-http3-stub",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9e995d52485cdb3f5eaf00457847ee42"
},
"target_context": {
"dst_port": 4433,
"service": "quic-http3-stub",
"service_name": "quic-http3-stub",
"risk_score": 31
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "185ff9c97d583c98932416f721dbe169440a38dd",
"protocol_details": {
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)",
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab quic_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 31\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 31,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 31,
"risk_label": "Faible",
"service_name": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB",
"dst_port": 4433,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-quic-http3-stub",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 4433,
"service": "quic-http3-stub",
"service_label_fr": "QUIC HTTP3 STUB"
},
"attack_vector": "quic probe \u00b7 via QUIC HTTP3 STUB:4433 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4433 \u00b7 QUIC HTTP3 STUB",
"emulator_service": "quic-http3-stub",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "quic_http3_stub",
"service_banner": "honeypot-quic-http3-stub",
"service_os": "linux",
"dst_port": "4433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"https",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_quic_probe",
"quic_http3_stub_emulated"
]
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
Scan de ports
port scan syn · via PHAROS:4443 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +12
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "pharos",
"app_proto": "pharos",
"asn": 215540,
"country": "IQ",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "93af5bd83e6a0d23d9161339bc87a8f834b82c18",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 12
},
"named_classification_skipped": false,
"service_name": "pharos",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0976a6e656b0d44a3a4f599f9fe22e39096d598",
"protocol_details": {
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "port scan syn \u00b7 via PHAROS:4443 \u00b7 (reconnaissance)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PHAROS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 12
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"scan_rapide",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +12",
"protocol_details": {
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "port scan syn \u00b7 via PHAROS:4443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 30,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"https",
"pharos",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 12,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
10443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:10443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 10443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1be5d932cf15ea56c6c2fea31cdb1c2d56585e66",
"event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "083bfd062829a4f8b3682682fe99b421b1e7aba5",
"protocol_details": {
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 10443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 10443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:10443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "10443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "10443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
4433,
4443,
8443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 40,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"https",
"pharos",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "https",
"app_proto": "https",
"asn": 215540,
"country": "IQ",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9e051dab14e664422e109355079a354ee45b9a69",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0600"
],
"matched_pattern_names": [
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53d7fd4494e0cbc93dacfe1b065336fe862d5a14",
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
4433,
4443,
8443,
9443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 50,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"https",
"pharos",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe"
]
}
|
|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
Scan de ports
port scan syn · via ORACLE EM:7443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_em_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "oracle-em",
"app_proto": "oracle-em",
"asn": 215540,
"country": "IQ",
"dst_port": 7443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a0fb4e230f74128288b97013feb2ed16cb862a7f",
"event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "oracle-em",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7443,
"service": "oracle-em",
"service_name": "oracle-em",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "851ec9c23b4bbce3620b6d740787f2aa2235cb64",
"protocol_details": {
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ORACLE EM \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "oracle-em",
"service_label_fr": "ORACLE EM",
"dst_port": 7443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle-em",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle_em",
"service_banner": "honeypot-oracle-em",
"service_os": "linux",
"dst_port": "7443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
4433,
4443,
7443,
8443,
9443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 60,
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"https",
"oracle-em",
"pharos",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_oracle_tns_probe",
"oracle_em_emulated"
]
}
|
|
|
TCP |
444
|
—
|
Scan de ports
port scan syn · port 444 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
444
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Global Connectivity Solutions Llp",
"service": null,
"app_proto": null,
"asn": 215540,
"country": "IQ",
"dst_port": 444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "056335f033229c5415715141161772f521874b4b",
"event_fingerprint": "9c68d6b57f5ee2b7ddca7229ea7e72ab4daa9aa4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 444,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20381b249a8de76a876503430063f719f1032365",
"protocol_details": {
"port": 444
},
"attack_vector": "port scan syn \u00b7 port 444 \u00b7 (reconnaissance)",
"target_port_label": "444",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 444,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 444
},
"attack_vector": "port scan syn \u00b7 port 444 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "444",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
444,
4433,
4443,
7443,
8443,
9443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 70,
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"https",
"oracle-em",
"pharos",
"port:444",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
4434
|
—
|
Scan de ports
port scan syn · port 4434 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4434
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": null,
"app_proto": null,
"asn": 215540,
"country": "IQ",
"dst_port": 4434,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d8fed822e41045cb0f4c1beb930afeca45a75f0e",
"event_fingerprint": "0fabc1913a057eabeb7af3e2c58492eff3dfd4c1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4434,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d2e376ce3d3d7a95922785e8e3052a9599f59bf",
"protocol_details": {
"port": 4434
},
"attack_vector": "port scan syn \u00b7 port 4434 \u00b7 (reconnaissance)",
"target_port_label": "4434",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4434,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 4434
},
"attack_vector": "port scan syn \u00b7 port 4434 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "4434",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
7443,
8443,
9443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 80,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"https",
"oracle-em",
"pharos",
"port:4434",
"port:444",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
4444 · I2P
|
i2p
|
Scan de ports
port scan syn · via I2P:4444 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
I2P
WAF
—
Recommandation
Surveiller
Tags
i2p_emulated
net_i2p_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4444
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000010000000000000000000000000",
"emulator_response_len": 16,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "i2p",
"app_proto": "i2p",
"asn": 215540,
"country": "IQ",
"dst_port": 4444,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9af9a8526e404bdf6e50fb047fd3be7c5fa4845b",
"event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "i2p",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4444,
"service": "i2p",
"service_name": "i2p",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51f2fe627bbe8e43a224b18fab2bd25d0a008f88",
"protocol_details": {
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via I2P \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "i2p",
"service_label_fr": "I2P",
"dst_port": 4444,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-i2p",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 4444,
"service": "i2p",
"service_label_fr": "I2P"
},
"attack_vector": "port scan syn \u00b7 via I2P:4444 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "4444 \u00b7 I2P",
"emulator_service": "i2p",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "i2p",
"service_banner": "honeypot-i2p",
"service_os": "linux",
"dst_port": "4444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
7443,
8443,
9443,
10443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 90,
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"https",
"i2p",
"oracle-em",
"pharos",
"port:4434",
"port:444",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"i2p_emulated",
"net_i2p_probe"
]
}
|
|
|
TCP |
18443
|
—
|
Scan de ports
port scan syn · port 18443 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": null,
"app_proto": null,
"asn": 215540,
"country": "IQ",
"dst_port": 18443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "54f4f77336edcd8fc43f1812bccf4b5675a73269",
"event_fingerprint": "480806a1c85fd8d8c684db38b9a52bbe915cf156",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 18443,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c6db565c1c9cf255a7bd0d58711cd4002a8eefa",
"protocol_details": {
"port": 18443
},
"attack_vector": "port scan syn \u00b7 port 18443 \u00b7 (reconnaissance)",
"target_port_label": "18443",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 18443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 18443
},
"attack_vector": "port scan syn \u00b7 port 18443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "18443",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "18443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
7443,
8443,
9443,
10443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 100,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"https",
"i2p",
"oracle-em",
"pharos",
"port:18443",
"port:4434",
"port:444",
"quic-http3-stub"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Scan de ports
port scan syn · via K8S API:6443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
"emulator_response_len": 165,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 215540,
"country": "IQ",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "8100e0ba2951eda4f623efc9a065b92ccaae19c9",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7831a0932ab5639dd4f44654ff2355fc8cb2f0aa",
"protocol_details": {
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via K8S API \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 110,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:18443",
"port:4434",
"port:444"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"net_kubernetes_probe"
]
}
|
|
|
TCP |
15443
|
—
|
Scan de ports
port scan syn · port 15443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": null,
"app_proto": null,
"asn": 215540,
"country": "IQ",
"dst_port": 15443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e3ca86a15d4ab0d92dcd3d6ec5fb8e82cd7086ba",
"event_fingerprint": "b760a48de7929b49e010f53ba761c58f10ec9569",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15443,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9914a49ad9993b1dc39f78d1b5914f3e8c682d04",
"protocol_details": {
"port": 15443
},
"attack_vector": "port scan syn \u00b7 port 15443 \u00b7 (reconnaissance)",
"target_port_label": "15443",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 15443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"port": 15443
},
"attack_vector": "port scan syn \u00b7 port 15443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "15443",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "15443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 120,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:15443",
"port:18443",
"port:4434"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
11443
|
—
|
Scan de ports
port scan syn · port 11443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Global Connectivity Solutions Llp",
"service": null,
"app_proto": null,
"asn": 215540,
"country": "IQ",
"dst_port": 11443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5bf2f7aff48e7b86205a8c1fe609359f68b4f575",
"event_fingerprint": "05eac273e4930e0949511f8d52bf99e8502a10fa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IQ",
"asn": 215540,
"org": "Global Connectivity Solutions Llp",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 11443,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca123ccd72e735c5bb4700d34496eab2ec0f1134",
"protocol_details": {
"port": 11443
},
"attack_vector": "port scan syn \u00b7 port 11443 \u00b7 (reconnaissance)",
"target_port_label": "11443",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"port": 11443
},
"attack_vector": "port scan syn \u00b7 port 11443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "11443",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
444,
4433,
4434,
4443,
4444,
6443,
7443,
8443,
9443,
10443,
11443,
15443,
18443
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 130,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"https",
"i2p",
"k8s-api",
"oracle-em",
"pharos",
"port:11443",
"port:15443",
"port:18443"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|